docs(security): add SECURITY.md with coordinated disclosure guidance - #13
docs(security): add SECURITY.md with coordinated disclosure guidance#13donny-devops wants to merge 1 commit into
Conversation
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a SECURITY.md file to establish the repository's security policy, detailing the scope, supported versions, vulnerability reporting procedures, and a security roadmap. The feedback recommends adding a specific email address for contacting the maintainer directly to ensure the reporting instructions are complete and actionable.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| 2. Click **Report a vulnerability**. | ||
| 3. Fill in the details and submit. | ||
|
|
||
| Alternatively, you may email the maintainer directly. Include: |
There was a problem hiding this comment.
The policy mentions the option to email the maintainer directly, but no email address or contact link is provided. Please add the maintainer's email address.
| Alternatively, you may email the maintainer directly. Include: | |
| Alternatively, you may email the maintainer directly at security@example.com. Include: |
|
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR adds comprehensive security documentation with coordinated disclosure guidance, which is essential for security-adjacent projects. The structure and content are generally well-organized.
Critical Issue Identified:
- Missing maintainer email address for the alternative reporting method (Line 26)
Assessment:
The SECURITY.md file provides clear guidance on vulnerability reporting, disclosure policies, and scope. Once the email contact information is added, this will provide a complete security reporting framework for the project.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| 2. Click **Report a vulnerability**. | ||
| 3. Fill in the details and submit. | ||
|
|
||
| Alternatively, you may email the maintainer directly. Include: |
There was a problem hiding this comment.
🛑 Missing Critical Information: Add the maintainer's email address. The alternative reporting method instructs users to email the maintainer directly but provides no contact information, breaking this vulnerability reporting pathway.
| Alternatively, you may email the maintainer directly. Include: | |
| Alternatively, you may email the maintainer directly at [security@example.com]. Include: |
There was a problem hiding this comment.
Pull request overview
Adds a repository security policy document to define scope, supported versions, and a coordinated vulnerability disclosure process for Post-Quantum Studio.
Changes:
- Introduces
SECURITY.mddescribing reporting guidance and disclosure expectations. - Defines scope/out-of-scope items and a high-level security roadmap.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| 2. Click **Report a vulnerability**. | ||
| 3. Fill in the details and submit. | ||
|
|
||
| Alternatively, you may email the maintainer directly. Include: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fe7cdf66f9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 2. Click **Report a vulnerability**. | ||
| 3. Fill in the details and submit. | ||
|
|
||
| Alternatively, you may email the maintainer directly. Include: |
There was a problem hiding this comment.
When GitHub private vulnerability reporting is disabled or unavailable to a reporter, this fallback path is not actionable because it tells reporters to email the maintainer but provides no address or other contact; I checked the repo for contact/email references and only this new SECURITY.md mentions one. Please include a concrete security contact or remove the unusable fallback so vulnerability reports can still be sent privately.
Useful? React with 👍 / 👎.
|
Closing as superseded by #24, which bundles the CI workflow and SECURITY.md. Reopen if needed. |
No description provided.