feat(release): publish restructured security workspace

Author: madnessbrainsbl

.dockerignore

@@ -10,8 +10,6 @@ __pycache__
 data/cves_*.json
 !data/cves_public.json
 !data/cves_public.provenance.json
-cves_full.json
-cves_cvss9.json
 evidence/
 update_cves.py
 *.log

.github/workflows/pages.yml

@@ -1,7 +1,10 @@
 name: Pages
 
 on:
-  push:
+  # Deploy only after CI has finished, so a red build never reaches production.
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
     branches: [main]
   workflow_dispatch:
 
@@ -16,12 +19,21 @@ concurrency:
 
 jobs:
   deploy:
+    # workflow_dispatch has no source run, so let manual deploys through.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event.workflow_run.conclusion == 'success'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          # workflow_run checks out the default branch tip by default, which can
+          # already be a newer commit than the one CI validated. Pin to the exact
+          # SHA that passed, otherwise the gate proves nothing.
+          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
       - uses: actions/upload-pages-artifact@v5
         with:
           path: .

.gitignore

@@ -14,6 +14,7 @@ Desktop.ini
 .grok/
 .cursor/
 .agent/
+.opencode/
 
 # Python
 __pycache__/
@@ -41,6 +42,8 @@ playwright-report/
 *~
 *.orig
 *.rej
+tmp/
+tmp.count
 
 # Local evidence / hunt logs (not product)
 evidence/
@@ -52,7 +55,7 @@ evidence/
 id_rsa*
 credentials.json
 secrets/
-update_cves.py
+
 
 # Optional local NVD cache
 .nvd_cache/
@@ -64,8 +67,6 @@ update_cves.py
 data/cves_*.json
 !data/cves_public.json
 !data/cves_public.provenance.json
-cves_full.json
-cves_cvss9.json
 
 # Browser / local dumps
 localStorage*

CHANGELOG.md

@@ -2,16 +2,14 @@ FROM python:3.12-alpine
 
 WORKDIR /app
 
-COPY serve.py index.html cover.jpg robots.txt sitemap.xml README.md README.ru.md DISCLAIMER.md ./
+COPY serve.py index.html robots.txt sitemap.xml README.md README.ru.md ./
 COPY app/ app/
 COPY css/ css/
 COPY data/cves_public.json data/cves_public.provenance.json data/
 COPY education/ education/
-COPY image/ image/
 COPY js/ js/
 COPY offline-cve/ offline-cve/
 COPY owasp-labs/ owasp-labs/
-COPY ru/ ru/
 COPY source/ source/
 
 ENV ROOT_HOST=0.0.0.0 \

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-![RØOT cover](cover.jpg)
+![RØOT cover](source/cover.jpg)
 
 # RØOT
 
@@ -35,9 +35,10 @@ cloud lab, analytics service, or live target.
 | OWASP API Security mini-labs | 10 |
 | Bilingual quiz questions | 500 |
 | Public CISA KEV/CVE List V5 records | 250 |
-| Security tool references | 359 |
+| Security tool references | 420 |
+| Security standards and methods | 50 |
 | Payload examples in 66 categories | 1,224 |
-| Attack-chain scenarios | 108 |
+| Attack-chain scenarios | 114 |
 | Command builders | 59 |
 
 ![RØOT product tour](image/root-demo.gif)
@@ -48,7 +49,7 @@ cloud lab, analytics service, or live target.
 - Complete safe Web and API challenge simulations with hints and scoring.
 - Compare vulnerable implementations with focused remediation examples.
 - Search a local public CVE snapshot by ID, vendor, product, or severity.
-- Work with payload references, attack chains, command builders, checklists,
+- Work with payload references, attack chains and command builders,
   SQL queries, and report templates.
 - Keep progress and notes in the browser and export them as JSON.
 
@@ -61,7 +62,7 @@ Requirements: Python 3.10+ and a modern browser.
 ```bash
 git clone https://github.com/madnessbrainsbl/ROOT.git
 cd ROOT
-python serve.py
+python3 serve.py   # Windows: python serve.py
 ```
 
 Open <http://127.0.0.1:8080/> for the product page or
@@ -85,7 +86,7 @@ where available.
 
 - Sources and SHA-256: [`data/cves_public.provenance.json`](data/cves_public.provenance.json)
 - Reproducible builder: [`scripts/build_cve_seed.py`](scripts/build_cve_seed.py)
-- Third-party terms: [`THIRD_PARTY.md`](THIRD_PARTY.md)
+- Third-party notices and source terms: see below.
 
 Maintainers can rebuild the snapshot explicitly:
 
@@ -97,13 +98,20 @@ The application never downloads data on startup and exposes no update or
 credential endpoint. On Python it queries SQLite; on GitHub Pages it falls back
 to the same tracked JSON seed.
 
+Local `python3 serve.py` automatically uses ignored `data/cves_NNN.json` chunks
+when present and caches their fingerprint in SQLite. The temporary SQLite build
+uses the system temp directory, avoiding shared-folder locking issues. Set
+`ROOT_CVE_MODE=public` to force the 250-record public seed; GitHub Pages and
+Docker use that public dataset by default.
+
 ![Searchable public CVE snapshot](image/cve-catalog.jpg)
 
 ## Architecture
 
 ```text
 Browser (Vanilla JS)
-├── Web / API / LLM learning tracks
+├── Unified OWASP workspace: Web / API / LLM / ASVS
+├── SDLC security frameworks: STRIDE / SSDF / SLSA / CWE / CVSS / CIS
 ├── CTF simulations, quizzes, tools, payloads, and reports
 ├── sql.js knowledge workspace + browser progress
 └── GET /api/cves → Python stdlib server → SQLite
@@ -129,11 +137,96 @@ GET /api/cves/{CVE-ID}
 - Browser progress is local to the current browser profile.
 - Important CVE decisions must be verified against primary vendor advisories.
 
-## Contributing and responsible use
-
-Read [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md), and
-[DISCLAIMER.md](DISCLAIMER.md) before submitting code or security content.
-Use the material only on systems you own or are explicitly authorized to test.
-
-Apache-2.0 licensed. Third-party attributions are preserved in
-[THIRD_PARTY.md](THIRD_PARTY.md) and [`licenses/`](licenses/).
+## Responsible use
+
+RØOT is for learning and for testing systems you own or are explicitly
+authorized to assess. Do not use its examples, payloads, simulations, or command
+references to access, disrupt, alter, or extract data from another system.
+Follow applicable law, contracts, program rules, and coordinated-disclosure
+requirements.
+
+The bundled CVE snapshot is a study aid, not live threat intelligence. Confirm
+important details against the referenced CVE record, CISA entry, and vendor
+advisory before making an operational decision.
+
+## Reporting a vulnerability
+
+Report a suspected RØOT vulnerability privately through GitHub's **Report a
+vulnerability** form when available. Otherwise, open an issue with a
+non-sensitive summary and request a private contact channel. Include the
+affected version, reproduction steps, impact, and a minimal proof of concept;
+never include credentials, personal data, or unauthorized target data.
+
+The bundled labs are intentionally vulnerable. Their behavior is not a security
+issue unless it escapes the local simulation boundary.
+
+## Contributing
+
+Keep changes focused, avoid new production dependencies without agreement, and
+include the smallest relevant test. Content contributions must cite their
+sources and licenses; do not submit proprietary material, secrets, live target
+data, paid training content, or payload collections without compatible
+attribution. Contributions are distributed under Apache-2.0.
+
+## Release notes
+
+**0.1.0, 2026-07-22:** added bilingual landing pages, shareable routes, public
+CISA KEV/CVE List V5 seed data, the read-only CVE API, Docker support, and
+release CI. Removed proprietary CVE synchronization, credential handling, and
+startup downloads.
+
+Apache-2.0 licensed without warranty. License texts are in [`licenses/`](licenses/).
+
+## Third-party notices
+
+RØOT is licensed under Apache-2.0. The following bundled material remains
+subject to its own license or source terms.
+
+| Component or data | License / terms | Use in RØOT |
+|---|---|---|
+| [sql.js](https://github.com/sql-js/sql.js) | MIT | `js/vendor/sql-wasm.js` and `js/vendor/sql-wasm.wasm` power the browser SQL workspace. The license is in `licenses/sql.js-LICENSE.txt`. |
+| [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) | MIT | The payload reference library contains adapted examples. Attribution and the license are in `licenses/PayloadsAllTheThings-LICENSE.txt`. |
+| [OWASP ASVS 5.0.0](https://github.com/OWASP/ASVS/tree/v5.0.0) | CC BY-SA 4.0 | The ASVS overview uses official version, level, and chapter information. RØOT summaries are educational; official documents remain authoritative. |
+| Space Grotesk, JetBrains Mono, Orbitron, VT323 | SIL Open Font License 1.1 | Locally hosted web fonts. The license is in `licenses/fonts-OFL-1.1.txt`. |
+| [CISA KEV](https://github.com/cisagov/kev-data) | U.S. government/public data; see source notices | Supplies the bundled Known Exploited Vulnerabilities selection. |
+| [CVE List V5](https://github.com/CVEProject/cvelistV5) | See CVE Program terms and repository notices | Supplies published CNA descriptions, affected products, CWE, and CVSS fields where available. |
+
+The precise CVE seed sources, generation time, record count, and SHA-256 are
+recorded in `data/cves_public.provenance.json`. Regenerate it with
+`python scripts/build_cve_seed.py --limit 250`.
+
+### Standards and educational references
+
+- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
+- [OWASP API Security Top 10](https://owasp.org/API-Security/)
+- [OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/)
+- [OWASP Application Security Verification Standard](https://owasp.org/www-project-application-security-verification-standard/)
+- [OWASP Software Assurance Maturity Model](https://owasp.org/www-project-samm/)
+- [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
+- [OWASP Mobile Application Security](https://mas.owasp.org/)
+- [OWASP LLM Security Verification Standard](https://owasp.org/www-project-llm-verification-standard/)
+- [OWASP Threat Modeling](https://owasp.org/www-project-threat-modeling/)
+- [NIST Secure Software Development Framework, SP 800-218](https://csrc.nist.gov/pubs/sp/800/218/final)
+- [NIST Cybersecurity Framework 2.0](https://www.nist.gov/cyberframework)
+- [SLSA specification 1.2](https://slsa.dev/spec/v1.2/)
+- [Common Weakness Enumeration](https://cwe.mitre.org/)
+- [Common Attack Pattern Enumeration and Classification](https://capec.mitre.org/)
+- [MITRE ATT&CK](https://attack.mitre.org/)
+- [MITRE D3FEND](https://d3fend.mitre.org/)
+- [Common Vulnerability Scoring System 4.0](https://www.first.org/cvss/v4.0/)
+- [Exploit Prediction Scoring System](https://www.first.org/epss/)
+- [CISA SSVC](https://www.cisa.gov/resources-tools/resources/stakeholder-specific-vulnerability-categorization-ssvc)
+- [CISA Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
+- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
+
+Names, identifiers, and marks identify their respective public standards and
+catalogs. They do not imply endorsement of RØOT by OWASP, NIST, MITRE, CISA,
+the CVE Program, FIRST, the Linux Foundation, or the Center for Internet
+Security. RØOT summaries are educational; linked primary sources are
+authoritative.
+
+RØOT's application code, bilingual explanations, UI, simulated lab flows,
+attack-chain organization, and report templates are distributed under the
+project license unless a notice above says otherwise. Artwork and screenshots
+in `source/` and `image/` are covered by the project license unless noted in
+the file itself.