Repository navigation
docs: add CONTRIBUTING and SECURITY, and route findings away from public issues - #452
Merged
Merged
Conversation
…CURITY CONTRIBUTING.md carries the rule for where a maintainer's finding goes: the PR description when fixing now, one PR and one tracking issue per QA pass, an internal tracker for CI/test work, and a private advisory for anything security-relevant. SECURITY.md gives that private channel. AGENTS.md and the manual-QA skill point agents at it, since QA passes are where most issue-per-finding batches came from. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T6sZpGK1T6pcUKy6DNyUaT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a contributor guide and a security policy, and points agents at them so QA findings stop landing as one public issue each.
Changes
CONTRIBUTING.md(new): outside contributors are asked to open issues as normal. A maintainers section says where a finding goes: the PR description when it's being fixed now; one PR plus at most one tracking issue per QA pass; an internal tracker for CI and test work; a private advisory for anything security-relevant.SECURITY.md(new): report vulnerabilities through GitHub private vulnerability reporting (now enabled on the repo), with examples of what counts for this CLI.AGENTS.md: a short "Issues and findings" section. Agents don't open issues unless asked, security findings are never public, and everything else followsCONTRIBUTING.md.hookdeck-cli-manual-qaskill: a "Where findings go" subsection under Reporting, since QA passes are where most issues came from.Docs only. No CLI or test code changes, so the acceptance suite won't run.
🤖 Generated with Claude Code
https://claude.ai/code/session_01T6sZpGK1T6pcUKy6DNyUaT
Generated by Claude Code