fixdossier / Docs / Sample records

Sample security records

This is an unedited SECURITY-RECORD.md and security-record.json that fixdossier produced for a public repository. It lists the published security advisories and security-looking commits it found, the release that shipped each fix, and how that link was made. It shows what the output looks like on a real project, including the parts that need a human check.

Not requested or endorsed by the project. The project below did not ask for, review or endorse this record, and it is not claimed to use fixdossier. The record is generated from public GitHub data (published repository security advisories, releases, tags, merged pull requests and commit messages) using read-only API calls. If you maintain this project and want the record removed or corrected, write to contact@fixdossier.dev.

How it was generated

fixdossier v0.1.2 (commit f5d6fc5), run locally with node src/index.js --repo=owner/name --max_pages=10 on 2026-10-31. max_pages=10 is also the Action’s default.
Only published repository advisories are read. Draft or private advisories, and global advisories for a project’s dependencies, are not included.
The record is a snapshot of the day it was generated. Newer advisories and releases are not in it.

Records

PHPOffice/PhpSpreadsheet

Generated 2026-10-31 · fixdossier v0.1.2 · 145 releases read

advisories

mapped via advisory

mapped by date

unmatched

releases with a fix

keyword commit rows

87 (9)

bot updates (security)

gaps

All 32 published advisories carry patched_versions, and every one matched a release tag. Most fixes were shipped on several maintenance lines at once (for example 5.10.0, 3.10.8, 2.4.8, 2.1.19 and 1.30.7 on the same day), so a single advisory row can list up to five releases. The one keyword commit row is titled “Security Policy Updates” and is listed as not yet in a release; keyword rows like this need a human look to decide whether they are fixes at all.

Full record JSON Markdown github.com/PHPOffice/PhpSpreadsheet

PHPOffice/PhpSpreadsheet did not request, review or endorse this record, and no claim is made that the project uses fixdossier. It was generated from public GitHub data only (published security advisories, releases, tags, merged pull requests and commit messages).

Counts

Repo	Advisories	Via advisory	By date	Unmatched	Keyword commit rows	Bot updates (security)	Releases	Gaps
PHPOffice/PhpSpreadsheet	32	32	0	0	1 (0 tag, 0 date, 1 unreleased)	87 (9)	145	2 paging, 0 permission

“Via advisory”: the advisory’s patched_versions matched a release tag. “By date”: placed on the first stable release on or after the advisory was published. “Paging” gaps mean pull request or commit history was cut at 10 pages; the record has no permission gap. See how an advisory is mapped to a release.

Run it on your repo

Save as .github/workflows/security-record.yml. Artifact mode is the default and needs only read permissions.

yaml

name: security-record
on:
  release:
    types: [published]
  schedule:
    - cron: '0 6 * * 1'   # weekly
  workflow_dispatch:
permissions:
  contents: read
  pull-requests: read
jobs:
  record:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: itulo/fixdossier@v0

The Action is free and MIT-licensed. See Build a dated record of security fixes for inputs and commit mode. If you want a hosted review queue and signed exports, there is an optional paid service, fixdossier Pro: a €69 one-time Founding Licence (VAT included, 14-day refund), active for as long as the service runs.

Docs pages

Not legal advice. fixdossier is an engineering tool for evidence collection and review support. It is not legal advice and not a compliance certificate. It does not make a product compliant with the PLD, the CRA or anything else, and its output can be incomplete or wrong. Review it, and ask a lawyer about your situation.