Skip to content

docs(builder): clean SECURITY.md commit (remove real email from commit body) #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
iap wants to merge 1 commit into from
Closed

docs(builder): clean SECURITY.md commit (remove real email from commit body) #93

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Security Policy

## Reporting a Vulnerability

Security is a top priority for the Hermes builder plugin. If you believe you have found a security vulnerability, please report it to us.

### How to Report

- **Email**: `iap@users.noreply.github.com` (GPG: `0049 2CBB E90A F475 521F 68B9 9166 D30F 6FE7 0F56`)

@greptile-apps greptile-apps Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Security reporting email cannot receive messages

iap@users.noreply.github.com is a GitHub noreply identity address, not a maintainer-controlled inbox. DNS and SMTP routing checks for that exact recipient found no MX record or fallback address, so researchers who use the documented email option cannot deliver a report or receive the stated acknowledgment. Replace it with a monitored maintainer mailbox, or remove the email option and direct reporters exclusively to monitored GitHub Security Advisories.

T-Rex Ran code and verified through T-Rex

Fix in Cursor

- **GitHub Security Advisories**: Use the "Report a vulnerability" button on the [Security tab](https://github.com/iap/builder/security/policy)

### What to Include

Please include the following in your report:

1. A description of the vulnerability and its impact
2. Steps to reproduce the issue
3. Any proof-of-concept code or exploit
4. Your contact information and availability

### Response Timeline

- We will acknowledge your report within 48 hours
- We will provide a more detailed response within 7 days
- We will keep you informed of the progress towards a fix
- If the vulnerability is confirmed, we will coordinate a disclosure timeline

### Scope

This policy covers all repositories under the `iap/builder` GitHub organization. Please note that this plugin is a guest in the Hermes ecosystem — core Hermes security issues should be reported to [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent) instead.

### Preferred Languages

We prefer reports in English.
Loading