From 715a95d3731fe133168121c117a4787f604ab22b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 25 Aug 2026 23:02:04 +0100 Subject: [PATCH] docs(security): add SECURITY.md pointer to SECURITY.adoc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three things are currently broken by the absence of a literal SECURITY.md, and one file fixes all of them: * code-scanning alert #705 hypatia/scorecard/SecurityPolicy * code-scanning alert #704 hypatia/cicd_rules/missing_requirement * scorecard-enforcer.yml's check-critical job, which runs `if [ ! -f "SECURITY.md" ]` and has been FAILING ON EVERY PUSH (confirmed on the 2026-08-24 and 2026-08-25 runs) The repo has a full 12KB SECURITY.adoc plus SECURITY-ADVISORIES.adoc; the policy is not missing, only the filename these checks look for. Every community-health doc in this estate is .adoc by deliberate convention. A pointer rather than a copy, so there stays exactly one source of truth. Both alerts come from Hypatia, whose SARIF pipeline is LIVE (alerts updated 2026-08-24), so they will close on the next scan. Note this is NOT true of the 12 Scorecard-sourced alerts in this repo, which are frozen at 2026-06-03 — see the separate finding on that. Co-Authored-By: Claude Opus 5 --- SECURITY.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..4f3b055f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,35 @@ + + +# Security Policy + +**The security policy for this repository lives in [`SECURITY.adoc`](SECURITY.adoc).** + +Please read that file. It is the authoritative document and covers the GitHub +Security Advisories workflow, the response timeline, and the coordinated +disclosure policy. See also [`SECURITY-ADVISORIES.adoc`](SECURITY-ADVISORIES.adoc). + +## Why this file exists + +This estate writes prose in AsciiDoc, so every community-health document here is +`.adoc` — `README`, `CONTRIBUTING`, `CODE_OF_CONDUCT`, `GOVERNANCE` and +`SECURITY` alike. That is a deliberate convention, not an omission. + +Several tools nonetheless look for the literal filename `SECURITY.md` and +report the policy as missing when they do not find it: + +- `hypatia/scorecard/SecurityPolicy` and `hypatia/cicd_rules/missing_requirement` + raise code-scanning alerts against this repository +- `.github/workflows/scorecard-enforcer.yml`'s `check-critical` job runs + `if [ ! -f "SECURITY.md" ]` and **fails on every push** without it + +This pointer satisfies those literal filename checks without duplicating the +policy text, so there is exactly one source of truth. Do not copy the policy +into this file — it will drift. + +The alternative fix would be to teach the Hypatia rule and the enforcer script +to accept `SECURITY.adoc`. That is the more consistent long-term answer and is +worth doing, but it changes two pieces of shared infrastructure rather than +adding one pointer file.