From 72b691fab853e4c83f7f216a676bc7b0619dbad2 Mon Sep 17 00:00:00 2001 From: Iko Date: Sun, 9 Aug 2026 13:25:34 +0000 Subject: [PATCH] docs(builder): add proper SECURITY.md with project contact info (#92) GitHub auto-generates a default security policy page, but there was no SECURITY.md in the repo. Create one with GitHub Security Advisories as the vulnerability reporting channel, with a GPG key for encrypted disclosures. --- SECURITY.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..04b25d5 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,35 @@ +# Security Policy + +## Reporting a Vulnerability + +Security is a top priority for the Hermes builder plugin. If you believe you have found a security vulnerability, please report it to us. + +### How to Report + +- **GitHub Security Advisories**: Use the "Report a vulnerability" button on the [Security tab](https://github.com/iap/builder/security/policy) + - This is the primary and monitored channel for security reports + - GitHub will mediate initial contact and coordinate disclosure + +### What to Include + +Please include the following in your report: + +1. A description of the vulnerability and its impact +2. Steps to reproduce the issue +3. Any proof-of-concept code or exploit +4. Your contact information and availability + +### Response Timeline + +- We will acknowledge your report within 48 hours +- We will provide a more detailed response within 7 days +- We will keep you informed of the progress towards a fix +- If the vulnerability is confirmed, we will coordinate a disclosure timeline + +### Scope + +This policy covers all repositories under the `iap/builder` GitHub organization. Please note that this plugin is a guest in the Hermes ecosystem — core Hermes security issues should be reported to [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent) instead. + +### Preferred Languages + +We prefer reports in English.