docs: add SECURITY.md - #80
Conversation
Points at security@pgedge.com as the single reporting route and at the pgEdge Vulnerability Disclosure Statement for scope, safe harbour and CVE handling. Identical across every pgEdge product repository. Do not merge before pgEdge/pgedge-docs#138 publishes docs.pgedge.com/security; until it does, the only link in this file 404s.
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| Security | 1 high (1 false positive) |
| Comprehensibility | 1 minor |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
It pointed reporters at security/advisories/new, GitHub's private vulnerability reporting form. That is disabled org-wide and stays disabled, so the link is dead and the file offered no email fallback. It also promised a fix timeline, which is not something we have approved. A file in .github/ takes precedence over one in the root, so the new root SECURITY.md does not supersede it on its own.
1 participant
Adds
SECURITY.mdto the repository root. It names security@pgedge.com asthe single reporting route and points at the pgEdge Vulnerability Disclosure
Statement for scope, safe harbour and CVE handling.
The file is identical in every pgEdge product repository — nothing in it is
repo-specific.
Why an in-repo copy when there is an org default
pgEdge/.githubcarries the same file as an organisation default, which coversevery repository that has none of its own. Defaults do not appear in a
repository's file tree, git history, clones or release archives — only in the
Security tab. A product a customer clones or vendors should carry its own
policy, and OpenSSF Scorecard's security-policy check only looks in the
repository itself.
Draft on purpose — merge order matters
The only link in this file is
https://docs.pgedge.com/security, and that URLreturns 404 today. Merging before the statement is live publishes a
security policy whose one actionable link is dead.
Merge order:
docs.pgedge.com/security. Out ofdraft and awaiting review.
No action needed from you until #138 merges. Reviews welcome now.
Also removes
.github/SECURITY.mdThis repository already carried its own policy at
.github/SECURITY.md. Itdirected reporters to
security/advisories/new— GitHub's privatevulnerability reporting form, which is disabled across the pgEdge org and stays
disabled — so the link was dead, and there was no email fallback. It also
promised a fix timeline, which has not been approved.
A file in
.github/takes precedence over one in the repository root, so thenew root file does not supersede it on its own. It has to go in the same PR or
coldfrontkeeps serving the dead link.