docs: replace security email with GitHub private advisory flow#35
Merged
docs: replace security email with GitHub private advisory flow#35
Conversation
The oss@axonops.com email appeared in four load-bearing
contexts — security reporting, CoC enforcement, CLA legal
inquiries, and the CLA Assistant comment. GitHub's private
vulnerability reporting is the right primary channel for
security reports now that it is enabled on this repo, so
replace the email-led flow in:
* SECURITY.md — primary channel is now
https://github.com/axonops/syncmap/security/advisories/new
(GitHub Security → Report a vulnerability). The advisory
stays private until the fix ships; reporters attach PoC
and crash dumps directly rather than mailing them.
* README.md "Security" section — links to the advisory flow.
* CONTRIBUTING.md security paragraph — same.
* cla.yml "please sign" comment — "open a discussion" no
longer applies (Discussions is off on this repo); pointed
at issues instead.
* documentation_test.go — TestGovernance_SecurityPolicyExists
now asserts the "security/advisories/new" link rather than
the email address.
Left untouched (email is genuinely the right channel, not
replaceable by a GitHub flow):
* CODE_OF_CONDUCT.md enforcement contact — CoC reports
benefit from a non-GitHub channel for anonymous reporters
and reporters who don't want to interact through the repo.
* CONTRIBUTING.md CoC-reporting line — same reason.
* CLA.md corporate-CLA legal inquiry — legal questions from
employers / organisations land here, email is the standard
channel.
No code change. Coverage remains 100%. llms-full.txt
regenerated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
`oss@axonops.com` appeared in four distinct contexts across the docs. Three of them (security reporting, README's security section, CONTRIBUTING's security paragraph) are better served by GitHub's private vulnerability reporting flow, which was enabled on the repo earlier today. The advisory interface gives reporters a private channel without email, and the maintainer response stays visible in the Security tab.
Kept as email (deliberately)
Diff shape
Validation