
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
import fs from 'fs-extra'; import path from 'path';
const tierDescriptions = { s: 'Fast Lane (Tier S) - minimal pipeline for bugfixes and small changes', m: 'Standard (Tier M) - 5-phase pipeline for feature blocks', l: 'Full (Tier L) - complete governance pipeline for complex, long-running projects', };
export async function generateReadme(config, targetDir) { const tier = (config.tier || 's').toLowerCase(); const tierDesc = tierDescriptions[tier] || '';
const content = `# ${config.projectName}
${config.description}
```bash ${config.installCommand || 'npm install'} ${config.devCommand || 'npm run dev'} ```
```bash ${config.testCommand || 'npm test'} ${config.typeCheckCommand ? config.typeCheckCommand + ' # type check' : ''} ```
This project uses Claude Code with a governance scaffold provided by tierward.
Pipeline: ${tierDesc}
Key files:
Every AI-assisted commit is tagged via `attribution.commit` in `.claude/settings.json` and should be reviewed by a human before merging to shared branches.
| Control | How it works |
|---|---|
| Test gate | Claude cannot complete a task until `${config.testCommand |
| Audit log | Every tool use is logged to `~/.claude/audit/` |
| Secret scanning | Pre-commit hook blocks accidental credential commits |
| CODEOWNERS | `.claude/` directory requires tech lead review on all PRs |
See `.github/PULL_REQUEST_TEMPLATE.md` for the PR checklist. All PRs that include AI-generated code must complete the AI review checklist. `;
await fs.writeFile(path.join(targetDir, 'README.md'), content); }
FAQs
Scaffold for legible, reviewable AI-assisted development
The npm package tierward receives a total of 54 weekly downloads. As such, tierward popularity was classified as not popular.
We found that tierward demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.