Enhance security policy with reporting and disclosure details - #19
Enhance security policy with reporting and disclosure details#19donny-devops wants to merge 1 commit into
Conversation
Expanded the security policy to include detailed reporting guidelines, response expectations, and responsible disclosure practices.
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
This PR adds a comprehensive security policy document to the repository, which is a valuable addition for establishing clear vulnerability reporting procedures and responsible disclosure guidelines.
Critical Issues Found
Broken Reference Markers: The document contains undefined reference markers ([web:154], [web:164], [web:159], [web:160], [web:165], [web:167]) that are not defined anywhere in the document. These broken citations will confuse readers and prevent them from accessing the referenced documentation. All instances must be removed before merging.
Recommendation
Fix the broken reference markers in lines 20, 66, and 70, then this security policy will be ready to merge.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
|
|
||
| ## Security Hygiene | ||
|
|
||
| Project maintainers may use repository protections such as dependency review, secret scanning, code scanning, and CI-based checks where available. A documented security policy is a recommended repository security practice and helps contributors know how to report issues safely. [web:159][web:160][web:165] |
There was a problem hiding this comment.
🛑 Documentation Error: Remove undefined reference markers [web:159][web:160][web:165]. These citations are not defined anywhere in the document and will break when users click them.
| Project maintainers may use repository protections such as dependency review, secret scanning, code scanning, and CI-based checks where available. A documented security policy is a recommended repository security practice and helps contributors know how to report issues safely. [web:159][web:160][web:165] | |
| Project maintainers may use repository protections such as dependency review, secret scanning, code scanning, and CI-based checks where available. A documented security policy is a recommended repository security practice and helps contributors know how to report issues safely. |
|
|
||
| Please **do not** open public GitHub issues or pull requests for suspected security vulnerabilities. | ||
|
|
||
| Instead, use GitHub’s private vulnerability reporting flow from the repository’s **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. [web:154][web:164] |
There was a problem hiding this comment.
🛑 Documentation Error: Remove undefined reference markers [web:154][web:164]. These citations are not defined anywhere in the document and will break when users click them, preventing readers from accessing the referenced GitHub documentation about private vulnerability reporting.
| Instead, use GitHub’s private vulnerability reporting flow from the repository’s **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. [web:154][web:164] | |
| Instead, use GitHub's private vulnerability reporting flow from the repository's **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. |
|
|
||
| ## Disclosure and Credit | ||
|
|
||
| After a fix or mitigation is ready, maintainers may publish a GitHub security advisory or other coordinated disclosure notice as appropriate. Reporters may be credited unless they prefer to remain private. [web:154][web:167] |
There was a problem hiding this comment.
🛑 Documentation Error: Remove undefined reference markers [web:154][web:167]. These citations are not defined anywhere in the document and will break when users click them.
| After a fix or mitigation is ready, maintainers may publish a GitHub security advisory or other coordinated disclosure notice as appropriate. Reporters may be credited unless they prefer to remain private. [web:154][web:167] | |
| After a fix or mitigation is ready, maintainers may publish a GitHub security advisory or other coordinated disclosure notice as appropriate. Reporters may be credited unless they prefer to remain private. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new SECURITY.md file to define the repository's security policy. The review feedback points out several actionable improvements, specifically the removal or replacement of unresolved citation/reference tags (such as [web:154]) and the addition of a specific contact method for private vulnerability reporting when GitHub's reporting flow is unavailable.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
|
||
| Please **do not** open public GitHub issues or pull requests for suspected security vulnerabilities. | ||
|
|
||
| Instead, use GitHub’s private vulnerability reporting flow from the repository’s **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. [web:154][web:164] |
There was a problem hiding this comment.
There are unresolved citation/reference tags like [web:154][web:164] at the end of this paragraph. These should either be removed or replaced with actual markdown links to the relevant GitHub documentation.
| Instead, use GitHub’s private vulnerability reporting flow from the repository’s **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. [web:154][web:164] | |
| Instead, use GitHub’s private vulnerability reporting flow from the repository’s **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. |
|
|
||
| Instead, use GitHub’s private vulnerability reporting flow from the repository’s **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. [web:154][web:164] | ||
|
|
||
| If private reporting is unavailable for any reason, report privately to the maintainer with: |
There was a problem hiding this comment.
The policy mentions reporting privately to the maintainer if GitHub's private reporting is unavailable, but it does not provide any contact information (such as an email address or security contact page). Please add a specific contact method so security researchers can reach you securely.
| If private reporting is unavailable for any reason, report privately to the maintainer with: | |
| If private reporting is unavailable for any reason, report privately to the maintainer at [insert security email or contact link] with: |
|
|
||
| ## Security Hygiene | ||
|
|
||
| Project maintainers may use repository protections such as dependency review, secret scanning, code scanning, and CI-based checks where available. A documented security policy is a recommended repository security practice and helps contributors know how to report issues safely. [web:159][web:160][web:165] |
There was a problem hiding this comment.
There are unresolved citation/reference tags like [web:159][web:160][web:165] at the end of this paragraph. These should be removed or replaced with actual links.
| Project maintainers may use repository protections such as dependency review, secret scanning, code scanning, and CI-based checks where available. A documented security policy is a recommended repository security practice and helps contributors know how to report issues safely. [web:159][web:160][web:165] | |
| Project maintainers may use repository protections such as dependency review, secret scanning, code scanning, and CI-based checks where available. A documented security policy is a recommended repository security practice and helps contributors know how to report issues safely. |
|
|
||
| ## Disclosure and Credit | ||
|
|
||
| After a fix or mitigation is ready, maintainers may publish a GitHub security advisory or other coordinated disclosure notice as appropriate. Reporters may be credited unless they prefer to remain private. [web:154][web:167] |
There was a problem hiding this comment.
There are unresolved citation/reference tags like [web:154][web:167] at the end of this paragraph. These should be removed or replaced with actual links.
| After a fix or mitigation is ready, maintainers may publish a GitHub security advisory or other coordinated disclosure notice as appropriate. Reporters may be credited unless they prefer to remain private. [web:154][web:167] | |
| After a fix or mitigation is ready, maintainers may publish a GitHub security advisory or other coordinated disclosure notice as appropriate. Reporters may be credited unless they prefer to remain private. |
There was a problem hiding this comment.
Pull request overview
This PR adds a repository-level SECURITY.md describing how to privately report vulnerabilities, what kinds of issues are in scope for this demo/reference cryptography project, and how disclosure is coordinated.
Changes:
- Introduces a Security Policy document with supported-version guidance.
- Adds private reporting instructions and response-time expectations.
- Documents responsible disclosure practices and scope notes tailored to a reference studio.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| Please **do not** open public GitHub issues or pull requests for suspected security vulnerabilities. | ||
|
|
||
| Instead, use GitHub’s private vulnerability reporting flow from the repository’s **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. [web:154][web:164] |
|
|
||
| ## Security Hygiene | ||
|
|
||
| Project maintainers may use repository protections such as dependency review, secret scanning, code scanning, and CI-based checks where available. A documented security policy is a recommended repository security practice and helps contributors know how to report issues safely. [web:159][web:160][web:165] |
|
|
||
| ## Disclosure and Credit | ||
|
|
||
| After a fix or mitigation is ready, maintainers may publish a GitHub security advisory or other coordinated disclosure notice as appropriate. Reporters may be credited unless they prefer to remain private. [web:154][web:167] |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a0c186ff4c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| Instead, use GitHub’s private vulnerability reporting flow from the repository’s **Security** tab by clicking **Report a vulnerability**. GitHub documents this as the recommended private reporting path for repositories with private vulnerability reporting enabled. [web:154][web:164] | ||
|
|
||
| If private reporting is unavailable for any reason, report privately to the maintainer with: |
There was a problem hiding this comment.
When GitHub private reporting is unavailable, this fallback tells researchers to report “to the maintainer” but SECURITY.md/README/package.json do not identify a private email, handle, or other channel. Since the policy also tells them not to use public issues or PRs, that context leaves security reports with no actionable private route unless the GitHub button is enabled; please include a concrete contact or remove the unavailable fallback.
Useful? React with 👍 / 👎.
|
Closing as superseded by #24, which bundles the CI workflow and SECURITY.md. Reopen if needed. |
Expanded the security policy to include detailed reporting guidelines, response expectations, and responsible disclosure practices.