Skip to content

docs(security): self-contained disclosure channel + document GitHub-native scanning #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dev-fani merged 2 commits into from
Aug 30, 2026
Merged

docs(security): self-contained disclosure channel + document GitHub-native scanning #163

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dad338c
docs(security): add a self-contained disclosure channel and document …
hartz0 Aug 30, 2026
c8f2f1f
Merge branch 'main' into docs/security-contact-and-automated-scanning
dev-fani Aug 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion docs/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,26 @@

## Reporting a Vulnerability

Please do not open a public GitHub issue for security vulnerabilities. Instead, email the maintainers (see the FaniLab organization contact in the smart contract repository's `SECURITY.md`) with a description, reproduction steps, and impact assessment. We aim to acknowledge reports within 5 business days.
Please do not open a public GitHub issue for security vulnerabilities.

**Report privately from this repository:**
<https://github.com/fanilabs/backend/security/advisories/new> — or click
**Report a vulnerability** under this repository's **Security** tab. GitHub's
private vulnerability reporting is enabled for this repo, so this form is a
direct, self-contained channel to the maintainers: no email address to guess,
no other repository to locate first. The report, the discussion, and fix
coordination all stay private until a patch ships.

Please include a description, reproduction steps, and an impact assessment. We
aim to acknowledge reports within 5 business days.

The FaniLab organization contact in the smart contract repository's
`SECURITY.md` remains valid as supplementary context, but the advisory form
above is sufficient on its own and is the preferred route.

`CODE_OF_CONDUCT.md`'s Enforcement section points here for conduct reports as
well — use the same **Report a vulnerability** form; it reaches the same
maintainers and stays private.

## Custody Model

Expand Down
Loading