[Security] No SECURITY.md — a published package with no private vulnerability-disclosure channel

[pathosDev]

Component: repository (process, not code)
Severity (assessment): LOW

actor-ts is published to npm with provenance and has a security label, a
[Security] issue template and a substantial history of security work — but there is
no SECURITY.md and no documented private reporting channel anywhere in the repo.

Exploit walkthrough

Not an exploit; a disclosure-process gap with a concrete failure mode. Someone who finds
a genuine, unfixed, remotely-exploitable defect in a published package has no private
route to report it. Their options are:

1. Open a public issue — which discloses a live vulnerability to everyone, including
   anyone running the affected version, before a fix exists.
2. Say nothing.

The repo's own security issue template already anticipates this and points at a file
that does not exist:

.github/ISSUE_TEMPLATE/security_report.yml:12-14
> ⚠️ **For pre-disclosure handling**, please first check
> the project's security policy in `SECURITY.md` (or, if
> absent, contact the maintainer privately).

"Contact the maintainer privately" is not actionable without a stated channel. GitHub
also surfaces a "Report a vulnerability" button only when private vulnerability
reporting is enabled, and links SECURITY.md from the repository's Security tab — both
are currently absent, so the discoverable path leads back to the public tracker.

Evidence

$ ls SECURITY.md .github/SECURITY.md docs/SECURITY.md
ls: cannot access 'SECURITY.md': No such file or directory
ls: cannot access '.github/SECURITY.md': No such file or directory
ls: cannot access 'docs/SECURITY.md': No such file or directory

.github/ contains ISSUE_TEMPLATE/, dependabot.yml and workflows/ — no security
policy.

Suggested fix

Add a SECURITY.md at the repository root covering the usual four points:

• Supported versions — pre-1.0, so realistically "latest minor only"; worth stating
  explicitly since 0.x users may assume older minors get backports.
• How to report privately — enable GitHub private vulnerability reporting
  (Settings → Code security) and/or name a contact address.
• What to expect — acknowledgement window and a disclosure timeline.
• Scope — worth being explicit that the cluster transport defaults to plaintext,
  unauthenticated TCP by design (documented in
  docs/src/content/docs/operations/security/cluster-security.mdx), so reports about
  that default are out of scope, while reports about the documented mitigations failing
  are very much in scope.

That last point is not boilerplate for this project: several audit findings are precisely
"the documented mitigation does not work", and drawing the line in SECURITY.md saves
triage effort on both sides.

Once the file exists, drop the "(or, if absent, …)" hedge from
.github/ISSUE_TEMPLATE/security_report.yml:13.

Verification status

Found during the 2026-08-01 whole-framework security audit, by direct inspection of the
repository rather than by the code-audit sweep. Verified: no SECURITY.md at the root,
in .github/, or under docs/.

[pathosDev]

Duplicate of #539, which was opened earlier today (18:48 UTC) and already carries SECURITY.md present and linked from the README as its first acceptance criterion. It post-dates the exclusion list this audit was screened against, so the overlap was not caught at filing time.

The substance of this issue — the dangling SECURITY.md reference in the security issue template, and the scope wording about the intentionally-unauthenticated cluster transport — has been added to #539 as a comment. Closing here to keep one issue per deliverable.

[pathosDev]

Reopening for consideration rather than arguing the original decision — one fact that may not have been visible when this was closed as not-planned.

.github/ISSUE_TEMPLATE/security_report.yml:12 currently tells reporters:

check the project's security policy in SECURITY.md

That file has never existed in this repository's history. So the template directs a finder of an unfixed remote defect at a document that is not there, and gh api repos/pathosDev/actor-ts/private-vulnerability-reporting returns {"enabled": false} — there is no private channel behind it either.

Whatever is decided about SECURITY.md itself, the template line pointing at it should either be removed or made true. GitHub's private vulnerability reporting is a repository setting and would satisfy the template's promise without a new file.

Raised as part of the production-readiness review tracked in #913; the disclosure-channel half is also covered by #539.