docs: add SECURITY.md and a documented disclosure policy - #35
Merged
Conversation
CONTRIBUTING.md and the README both told people not to open a public issue for a vulnerability and to use GitHub's private vulnerability reporting instead, but that instruction was buried at the bottom of two long documents with no SECURITY.md. GitHub surfaces a "Report a vulnerability" button on the Security tab and links the file from the repo sidebar only when SECURITY.md exists — without it, a researcher's most likely path is the one the docs ask them not to take. Adds SECURITY.md with: - explicit scope (testnet-stage, unaudited — stated plainly) - in-scope/out-of-scope, with known limitations linked to the issues tracking them (no upgrade path -> docs/MIGRATION.md, testnet-only deploy tooling -> ourdao#30, unaudited status -> Roadmap) - private vulnerability reporting as the primary channel - a stated response commitment (5 business days to acknowledge) - a coordinated-disclosure + credit policy README.md and CONTRIBUTING.md now point at SECURITY.md instead of repeating the instructions inline. Scope note: two acceptance-criteria items from ourdao#29 are outside what this PR (or this repo) can deliver: - Mirroring this in ourdao-backend and ourdao-frontend — I don't have forks of either repo. Noted as follow-up in SECURITY.md's own "Other repositories" section. - The private-vulnerability-reporting *setting* itself is currently disabled on ourdao/ourdao-contracts (confirmed via `gh api repos/ourdao/ourdao-contracts` -> security_and_analysis.enabled: false). Enabling it requires repo admin access this PR doesn't have. Refs ourdao#29
|
@oluwagbemigaphilip Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Claimed via comment on #29 before starting, per CONTRIBUTING.md.
What changed
Adds
SECURITY.mdat the repo root: explicit scope (testnet-stage, unaudited), in-scope/out-of-scope with known limitations linked to the issues tracking them, private vulnerability reporting as the primary channel, a stated response commitment, and a coordinated-disclosure/credit policy. README and CONTRIBUTING.md now point at it instead of repeating the instructions inline.Scope note — not a full close of #29
Two of #29's acceptance-criteria items are outside what this PR can deliver:
ourdao-backendandourdao-frontend. I don't have forks of either repo. Noted explicitly inSECURITY.md's "Other repositories" section as follow-up.ourdao/ourdao-contracts— confirmed viagh api repos/ourdao/ourdao-contracts --jq .security_and_analysis→{"enabled": false}. Enabling it needs repo admin access, which this PR doesn't have. Worth a maintainer flipping that toggle once this merges — otherwise the "Report a vulnerability" button won't actually appear on the Security tab despite the file being present.closes #18
closes #19
closes #30
closes #29