Add SECURITY.md with a private vulnerability path - #207
Conversation
README already told people not to file suspected vulnerabilities in public issues, but it advertised no private route. Point reporters at GitHub private advisories instead of inventing a contact email. Co-authored-by: APES Director <apescic-director@users.noreply.github.com>
Ship the security-policy file with the same-PR version bump required by the changelog contract, keeping public notes limited to the addition of SECURITY.md. Co-authored-by: APES Director <apescic-director@users.noreply.github.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c9c786666a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| value: | | ||
| Thank you for reporting a problem. Remove credentials, personal data, private operational identifiers, and transient authentication values from every field and attachment. | ||
| Do not use this public form for suspected security vulnerabilities. | ||
| Do not use this public form for suspected security vulnerabilities. Follow the private path in SECURITY.md. |
There was a problem hiding this comment.
When a security reporter follows the README's direct bug-report URL, they bypass the issue chooser and arrive at this form. SECURITY.md is plain text here rather than a Markdown link, so the form tells them not to proceed but provides no navigable route to the private advisory form; link the filename or use the advisory URL directly to reduce the risk of a public disclosure.
Useful? React with 👍 / 👎.
|
|
||
| ## Supported versions | ||
|
|
||
| Security reports are accepted for the current released MyAPES Core version on `main` (see [`VERSION`](VERSION)). Older beta versions may not receive a separate patch. |
There was a problem hiding this comment.
When release metadata has merged but the manual Cloudron deployment has not yet run, VERSION on main already names the new version while users are still running the previous release. This sentence therefore makes the actually deployed version appear unsupported and calls an undeployed version the current release; define support from the deployed/GitHub release, or explicitly cover both it and the version on main.
AGENTS.md reference: AGENTS.md:L107-L107
Useful? React with 👍 / 👎.
|
|
||
| [Report a vulnerability](https://github.com/APESCIC/MyAPES-Account/security/advisories/new) | ||
|
|
||
| That form creates a private security advisory visible only to repository administrators. You can also open **Security → Advisories → Report a vulnerability** on this repository. |
There was a problem hiding this comment.
When a reporter decides what sensitive evidence to submit, this absolute statement overstates the advisory's confidentiality: the reporter can access their own submission, maintainers can add advisory collaborators, and the advisory may later be published. Describe it as non-public and identify the actual permitted participants instead of promising that only repository administrators can see it.
Useful? React with 👍 / 👎.
2 participants
Fixes #126
README already told people not to disclose suspected security vulnerabilities in a public issue, but it advertised no private route. This PR adds
SECURITY.mdand points reporters at GitHub private vulnerability reporting.What this changes
SECURITY.mdwith GitHub private advisory reporting as the path to repository administratorsPublic issues and the Change Log Hub remain the wrong place for vulnerability reports. Release notes for this change say only that
SECURITY.mdwas added.GitHub private vulnerability reporting is now enabled on
APESCIC/MyAPES-Accountso the advisory form works for reporters.Tests
SecurityPolicyDocumentationTestcovers the advisory URL, README link, and issue-template pointersphp artisan myapes:changelog-validate --base-ref=origin/mainpassed on the PR branchRelease metadata
This PR includes v0.32.13 (
VERSION,resources/data/releases.json,resources/data/module-runtime-contract.json).