[repo-health] Low: No SECURITY.md — no vulnerability reporting policy or responsible disclosure channel

[Liohtml]

Finding

Severity: Low
Confidence: High
Check: Repository security policy

Description

The repository has no SECURITY.md file and no vulnerability reporting instructions anywhere in the docs. GitHub recognises SECURITY.md at the repo root (or in .github/) and surfaces a "Report a vulnerability" button in the Security tab — without it, that button is absent and reporters have no guidance on where to send findings responsibly.

Given that agentbox:

• bind-mounts host Claude OAuth credentials into a container
• ships an unauthenticated HTTP dashboard (Observer)
• has a growing list of security-relevant findings (now 14+ open issues)

...a clear private reporting channel matters. Without one, a researcher who finds something serious is likely to either go silent or disclose publicly.

Recommendation

Add a .github/SECURITY.md (or SECURITY.md at repo root) with at minimum:

1. Supported versions (which releases get patches)
2. A private contact method — e.g. a security@ email address, GitHub private vulnerability reporting (Settings → Security → Private vulnerability reporting → Enable), or a link to a security advisory form
3. Expected response time and disclosure policy

GitHub's adding a security policy guide covers the one-click path to enable private vulnerability reporting.

---

Filed by automated repo-health audit on 2026-06-17