chore: slim SECURITY.md and move release-gate runbook to docs/#473
Merged
Conversation
SECURITY.md was a 2.7 KB internal release-engineering runbook. The only thing a security researcher landing on that file needs is a private report channel. Everything else is ops detail. Split: - SECURITY.md: 5-line researcher-facing doc with GitHub private-reporting link - docs/release-secret-scan.md: full runbook (gitleaks gate, allowlist, local commands, incident procedure, why release-only) - .gitleaks.toml: add cross-link comment to new runbook - CONTRIBUTING.md: one-line link to new runbook
danieljohnmorris
force-pushed
the
chore/security-md-cleanup
branch
from
9fea529 to
2e161ba
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SECURITY.mdwas a 2.7 KB internal release-engineering runbook mixed with the one thing researchers actually need: a private report channel. Split them.SECURITY.mdis now 5 lines - GitHub private-reporting link only (no email per Dan's decision).docs/release-secret-scan.mdholds the full runbook: gitleaks gate, allowlist, local commands, incident procedure, why release-only..gitleaks.tomlheader gets a cross-link comment to the new runbook.CONTRIBUTING.mdgets a one-line link to the new runbook.Action item before merge
Flip on Private Vulnerability Reporting in repo settings before merging:
This adds a "Report a vulnerability" button to the Security tab that opens a private form - the canonical reporting channel referenced in the new SECURITY.md. The agent cannot enable this via CLI without admin token scope.
Notes
docs/is gitignored as scratch space, sodocs/release-secret-scan.mdis force-tracked viagit add -f. Consider adding!docs/release-secret-scan.mdto.gitignoreas a follow-up to make the exception explicit.Test plan
git grep -nP 'SECURITY\.md'returns no hits (nothing points to old runbook content)docs/release-secret-scan.mdrenders correctly on GitHub