Skip to content

fix(builder): remove real email from commit history on origin/main #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
iap wants to merge 1 commit into from
Closed

fix(builder): remove real email from commit history on origin/main #96

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
# Security Policy

## Reporting a Vulnerability

Security is a top priority for the Hermes builder plugin. If you believe you have found a security vulnerability, please report it to us.

### How to Report

- **GitHub Security Advisories**: Use the "Report a vulnerability" button on the [Security tab](https://github.com/iap/builder/security/policy)
- This is the primary and monitored channel for security reports
- GitHub will mediate initial contact and coordinate disclosure

### What to Include

Please include the following in your report:

1. A description of the vulnerability and its impact
2. Steps to reproduce the issue
3. Any proof-of-concept code or exploit
4. Your contact information and availability

### Response Timeline

- We will acknowledge your report within 48 hours
- We will provide a more detailed response within 7 days
- We will keep you informed of the progress towards a fix
- If the vulnerability is confirmed, we will coordinate a disclosure timeline

### Scope

This policy covers all repositories under the `iap/builder` GitHub organization. Please note that this plugin is a guest in the Hermes ecosystem — core Hermes security issues should be reported to [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent) instead.

@greptile-apps greptile-apps Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Security-policy scope names a repository as an organization

iap/builder resolves to this repository, owned by the iap user; it is not a GitHub organization. Saying that the policy covers all repositories under the iap/builder organization leaves reporters unable to tell whether it applies only to this repository or to a broader account scope. State the intended scope explicitly, such as “This policy covers only the iap/builder repository,” or name the actual organization/account if it is meant to cover multiple repositories.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Executable security-policy scope validation script

  • The exact Bash script executed from `/home/user/repo` reads line 31, derives the configured repository, and queries GitHub metadata; it proves the claimed organization path is not an organization.

Initial security-policy scope validation output

  • The initial captured command output shows line 31, the `iap/builder` origin path, a 404 literal organization lookup, and a 200 repository lookup; it shows the scope wording is ambiguous.

Expanded security-policy scope validation output

  • The final captured command output additionally extracts the live repository owner as `iap User` while the literal organization lookup remains 404; it confirms `iap/builder` is not an organization.

View artifacts

T-Rex Ran code and verified through T-Rex

Fix in Cursor


### Preferred Languages

We prefer reports in English.
Loading