governance: add root CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md and issue templates; mitigate bus factor

[IgorShevchik]

Background

Surfaced during the June 2026 multi-angle project audit (CTO + documentation reviews). Adjacent to #64 (which covers CODEOWNERS + branch protection — not repeated here).

Problems

1. No GitHub-surfaced governance files. There is no root (or .github/) CONTRIBUTING.md, no SECURITY.md (no vulnerability-disclosure contact), no CODE_OF_CONDUCT.md, and no issue forms. The content largely already exists — .github/contributing/*.md are excellent deep dives, AGENTS.md is a strong de-facto guide, the PR template is good — but GitHub's UX affordances never surface any of it, and README's mention of a "reporting bugs guide" has no link.
2. Bus factor = 1. git shortlog -sn: all 50 commits by one author; npm publish rights, sync-pipeline semantics, and release judgment live in one head. The written docs partially mitigate, but recovery from maintainer loss is unplanned.

Actions

• Thin root CONTRIBUTING.md pointing at AGENTS.md + .github/contributing/* + docs contribution page.
• SECURITY.md with a private disclosure contact and supported-versions note.
• CODE_OF_CONDUCT.md (standard Contributor Covenant).
• Two issue forms (bug report / feature request) matching the existing PR-template quality.
• Link the bug-reporting guide from README.
• (Owner action) Recruit/designate a second maintainer with npm-org and repo-admin access; write a 1-page release runbook (the .sync/ docs already form most of the handover package).

Priority: P2 (files are an hour of work; the bus-factor item is the strategically important one).

[IgorShevchik]

Two items inherited from #64, which is now closed. Its body deferred these to here, and this issue's body deferred them back there — so they were about to fall between the two.

CODEOWNERS

Still missing (.github/CODEOWNERS, root and docs/ variants all absent). It belongs with the rest of the governance files this issue collects, and it is the piece that makes review routing work at all once the repository has more than one maintainer.

Branch protection on main — owner action, cannot be done in code

This is a repository setting, so no PR can deliver it:

• require a pull request before merging;
• require the ci status check to pass;
• include administrators.

Worth stating why it matters now specifically. The publish pipeline built in #327 asserts that the commit it publishes is merged main history, and npm-publish.yml waits for a green ci on that exact SHA. Both are real gates — but without branch protection, main itself can be written directly, so the gates guard the publish rather than the branch. Turning on required checks is what makes the whole chain binding instead of advisory, and it costs one settings page.

Already done from #64, for the record

Least-privilege permissions: in all five workflows, SHA-pinning enforced by a CI check rather than convention, and no pull_request_target anywhere. Details in #64's closing comment.

---

Generated by Claude Code

[IgorShevchik]

#501 lands three of the six actions. Keeping this open — the remaining three are the strategically important half, and none of them can be delivered by a pull request.

Done

• Thin root CONTRIBUTING.md pointing at AGENTS.md, .github/contributing/* and the docs contribution page. A map, not a guide — every relative link is verified to resolve and every quoted script to exist.
• Two issue forms. The bug report requires a reproduction and argues for it in the field itself; both forms ask whether the behaviour exists upstream, because this is a fork and that answer decides which conversation the report starts.
• README linked. Line 107's "reporting bugs guide" pointed at nothing at all, exactly as this issue said. It now links the form, the section and CONTRIBUTING.md. The docs-site contribution page was also still filtering issues by label:v3 — upstream's label, matching nothing in a fork at 2.x.

Two guards came with it: governance-files.spec.ts (an issue form that breaks the schema is not an error anywhere — GitHub silently stops offering it and falls back to a blank box) and CONTRIBUTING.md added to documented-scripts.spec.ts.

Not done, and why

SECURITY.md — blocked on choosing a channel, not on writing the file. This repository publishes no contact: no author, no bugs, no email in any tracked file, and no org-level SECURITY.md to inherit. A policy naming a channel nobody watches is worse than none, because a researcher believes it.

Surveying the organisation turned this from a b24ui gap into an organisation-wide one. Seventeen public repositories, three security policies:

repository	channel
b24rabbitmq	GitHub private vulnerability reporting — correct
b24gosdk	GitHub private vulnerability reporting — correct
b24phpsdk	"Create issue with vulnerability details"

That third one is the urgent item, and it is not in this repository. It is a published instruction to disclose publicly, under a filename that makes it look official.

The two good ones use GitHub's private vulnerability reporting, which needs no email and no budget — one repository setting. So the precedent already exists inside the organisation; what is missing is the decision to apply it. b24gosdk even carries an unanswered note in its own file asking whether Bitrix24 has an official address.

CODE_OF_CONDUCT.md — same blocker. Contributor Covenant has a mandatory contact field for private reports.

A second maintainer, CODEOWNERS, and branch protection — owner actions, as this issue and its comment already say.

What would unblock the rest

1. Enable Settings → Security → Private vulnerability reporting on the public repositories. Highest value on b24phpsdk (it currently instructs public disclosure), then b24ui / b24jssdk / b24jssdk-nuxt, which ship to npm and end up inside production CRM integrations.
2. Say whether Bitrix24 has an official vulnerability address. If yes it becomes the primary channel; if no, the GitHub channel stands on its own.
3. Decide whether an organisation-level SECURITY.md in bitrix24/.github is acceptable — it would cover the fourteen repositories that have none, in one file.

Once any of those is settled, the file itself is half an hour of work, modelled on b24rabbitmq.

---

Generated by Claude Code

[IgorShevchik]

#503 lands SECURITY.md — four of six actions done. Still open for the remaining two, which no pull request can deliver.

Private vulnerability reporting is now enabled here, so the blocker named in the previous comment is gone for this repository. The policy points at /security/advisories/new, and CONTRIBUTING.md no longer tells reporters to sit on a finding.

Two things the policy states that most do not, both because they turned out to matter:

• The channel is private but not anonymous. GitHub requires an account and credits the reporter on the advisory. Worth saying in the file, so nobody discovers it halfway through filing.
• A reporter may disclose after 90 days. Framed as their entitlement rather than our promise — with one maintainer there is no on-call rotation behind "we will acknowledge and investigate", and silence should not bind someone indefinitely.

Still open

CODE_OF_CONDUCT.md — Contributor Covenant has a mandatory contact field for private reports, and a code-of-conduct report is not a security advisory, so the channel that unblocked SECURITY.md does not fit. Needs a decision.

A second maintainer, CODEOWNERS, and branch protection — owner actions, unchanged.

Elsewhere in the organisation

Re-checked while writing the policy. b24phpsdk still publishes a SECURITY.md whose reporting section reads "Create issue with vulnerability details", and private reporting is not enabled there — so a researcher following that file discloses publicly, and there is no private route even if they look for one. That remains the highest-value fix in the organisation and it is not in this repository.

b24jssdk has the channel enabled and no policy: the same half-finished state this repository was in yesterday.

One follow-up recorded

1.x and 0.x are published on npm and not marked deprecated, so npm i @bitrix24/b24ui-nuxt@^1.0.0 installs 1.0.4 today with no warning while this policy says those lines are unsupported. Closed with npm deprecate, which is a registry action rather than a repository one. Noted for a later pass, not lost.

---

Generated by Claude Code