feat(repo): add SECURITY.md, GOVERNANCE.md, MAINTAINERS.yaml and NOTICE - #19
Merged
Conversation
Until now the only security contact anywhere in this repository was one line in CONTRIBUTING.md pointing at security@stoplight.io — inherited with the fork. Anyone who found a vulnerability in this build and followed the instructions would have reported it to a company that does not maintain this code. For a project started because a supply-chain report went unanswered, that was the worst possible thing to have left unchecked. SECURITY.md routes reports to GitHub private vulnerability reporting (now enabled, #4) or info@apicommons.org, commits to a 5-business-day acknowledgement, scopes what belongs here versus upstream, and tells reporters they are free to publish if we go quiet. The window is deliberately conservative: it is set by what one maintainer can actually meet, and a missed self-imposed SLA would be worse than a modest one given the argument this project was founded on. GOVERNANCE.md is the honest interim version. One maintainer today, said plainly, with staged rules that escalate as the roster grows — the two-maintainer rule binds the original author identically to everyone else, and at Stage 0 the only real check on bad governance is that the licence lets you fork and lose nothing but the name. That is stated rather than papered over. It also carries the "what this will never do" list: no telemetry, no install scripts, no silent divergence, no breaking rulesets inside a major line, no commercial tier. MAINTAINERS.yaml puts the roster in data so changing it is a reviewable pull request. NOTICE states the attribution properly, records the v6.16.2 fork point, and says explicitly that neither Stoplight nor SmartBear maintains or endorses this build and that issues should not be reported to them. CONTRIBUTING.md's security line now points at SECURITY.md, and its stale Discussions link at this repository. The rest of that file is still upstream's and is flagged inline as such — the full rewrite is #6. Closes #5 Refs #9, #4, #6 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #5. Refs #9, #4, #6.
Until now the only security contact anywhere in this repository was one line in
CONTRIBUTING.mdpointing atsecurity@stoplight.io, inherited with the fork. Anyone who found a vulnerability in this build and followed the instructions would have reported it to a company that does not maintain this code.SECURITY.mdinfo@apicommons.orgGOVERNANCE.mdThe honest interim version, per #9. One maintainer, said plainly. Rules escalate by stage: lazy consensus and public threads at Stage 0; at Stage 1 the two-maintainer rule binds the original author identically to everyone else and is enforced by branch protection rather than discipline; employer caps at Stage 2.
It also states the check that actually exists today: at Stage 0 there is no independent body to appeal to, and pretending otherwise would be worse than admitting it. What there is instead is Apache-2.0, a complete git history, and a specification in a separate repository under a separate model — fork it and you lose nothing but the name.
Carries the "what this will never do" list #9 asked for: no telemetry, no install scripts, no silent divergence, no breaking rulesets inside a major line, no commercial tier.
MAINTAINERS.yamlThe roster as data, so changing it is a reviewable pull request. Upstream maintainers are explicitly not listed, with the reason stated in the file — they built this codebase, they are credited elsewhere, and none of them agreed to maintain this build.
NOTICEStates the attribution properly, records the fork point (
v6.16.2, upstreamdevelop, 2026-07-24), and says explicitly that neither Stoplight nor SmartBear maintains, endorses or is responsible for this build, and that issues should not be reported to them. Also states why thespectralbinary name is retained — nominative use for ruleset and CI compatibility, and nothing else.CONTRIBUTING.mdOnly the security line and the stale Discussions link are touched here, plus an inline note that the rest of the file is still upstream's. The full rewrite is #6 — this is not it.
Still open from #9
MIGRATING.mdis not here. It waits on #8, as that issue says.