docs(security): restack coordinated vulnerability disclosure after nanoid

[seonghobae]

Purpose

Clean protected-main successor for closed stale PR #72 after #76 integrated. This PR starts from protected main c85d710804139c0697d7ef8fa47d02b1389e6d84 and preserves the coordinated vulnerability-disclosure policy, handling lifecycle, bounded private-reporting status audit, tests, standards doctoring, and one current-baseline ## Unreleased changelog entry without replaying #72's pre-#76 package/workflow state.

Exact source / scope

• head branch: docs/coordinated-vulnerability-disclosure-on-main;
• exact current head: 1fc38bb3234f1ffca35989c52682ee76fce45b9b;
• independently resolved protected main: c85d710804139c0697d7ef8fa47d02b1389e6d84;
• direct-main successor: 11 commits ahead / 0 behind at the latest exact source read;
• changed-file set remains exactly 10 paths: CHANGELOG.md, SECURITY.md, disclosure doctoring/runbooks, bounded setting probe and three executable policy/audit regressions;
• no package, lockfile, workflow, nanoid, credential-exchange, reviewer-authority, release, deployment or licensing posture changes.

Historical PR #72 is closed unmerged; its old checks/reviews do not transfer.

Preserved security boundary

• private-first vulnerability intake with a content-free public fallback when GitHub private vulnerability reporting is unavailable;
• explicit pre-release support scope, bounded safe harbor, non-contractual response objectives, CVSS v4.0 plus exploitation-aware prioritization, coordinated disclosure, and no invented bounty/support commitment;
• evidence-preserving maintainer lifecycle covering exact-source validation, incident escalation, test-first remediation, independent review, immutable release/deployment evidence, recovery and lessons learned;
• bounded evidence retention by class, role-based access, legal-hold scope, expiry review, and secure deletion/redaction evidence;
• read-only GitHub status probe with organization-scoped endpoint construction, timeout, strict UTF-8 streaming, 16 KiB response ceiling, and fail-closed enabled === true semantics;
• standards doctoring grounded in ISO/IEC 29147:2018, ISO/IEC 30111:2019, NIST SP 800-61 Rev. 3, NIST CSF 2.0, FIRST CVSS v4.0, GitHub disclosure guidance and CISA KEV, with draft/future editions separated from published requirements.

Review remediation

CodeRabbit review of predecessor exact head 525aea3279ca3dcb4d84ff124496d6f338a7cf05 identified one valid test-contract weakness: the declared oversized-response regression asserted the size-limit error but did not prove the response body was never accessed before Content-Length rejection.

Current head adds a response fixture whose body getter throws if touched, preserving the expected size-limit rejection. The addressed inline review thread is resolved. Production bounded-reader behavior is unchanged.

Fresh exact-head technical evidence

For unchanged current head 1fc38bb3234f1ffca35989c52682ee76fce45b9b:

• application ci run 31383398820: terminal success;
• reviewer-ci run 31383399170: terminal success;
• central Security Scan run 31383398494: terminal success under its own scanner/revision semantics;
• the only CodeRabbit finding on the successor line is addressed and its inline thread is resolved;
• no qualifying independent non-author formal APPROVED review is established by current evidence;
• GitHub reports the content graph mergeable.

Technical green evidence is not live ruleset evidence or qualifying independent approval.

Operational boundary

This source does not prove that GitHub private vulnerability reporting is enabled, that an external reporter sees the private-reporting entry point, that notifications route correctly, that two independent security owners are staffed, or that a benign end-to-end private advisory exercise has passed. Issue #73 retains those administrator/operational acceptance requirements. A passing setting probe is setting evidence only and cannot substitute for review, branch governance, release, deployment, KPI or acquisition evidence.

Merge / protected-main acceptance

The implementation line is technically stable and Ready for review. Merge remains fail closed on the actual live #27/#29 governance and eligible independent-review path. After protected merge, run the read-only setting probe from protected source and retain its evidence separately from #73 reporter/UI/staffing/exercise acceptance.

No protection bypass, synthetic approval, version bump, release or claim of operational private reporting is introduced.

Related: #27, #29, #72, #73

[coderabbitai]

📝 Walkthrough

Walkthrough

공개 보안 정책과 취약점 처리 수명주기 문서를 추가했습니다. GitHub 비공개 취약점 신고 상태를 읽기 전용으로 검증하는 감사 프로브와 운영 런북을 추가했습니다. 프로브는 제한된 JSON 응답과 감사 결과를 검증합니다.

Changes

보안 취약점 운영

Layer / File(s)	Summary
보안 정책과 공개 계약 CHANGELOG.md, SECURITY.md, docs/doctoring/vulnerability-disclosure.md, test/security-policy-contract.test.ts	지원 범위, 비공개 신고, 세이프하버, 심각도 평가, 조정 공개, 증거 보존 및 정책 재검토 기준을 정의했습니다. 계약 테스트는 필수 정책 문구와 문서 구조를 fail-closed 방식으로 검증합니다.
취약점 처리 수명주기 docs/security/vulnerability-handling.md	취약점 접수부터 검증, 사고 전환, containment, test-first 수정, 독립 검토, 릴리스, 공개, 복구 및 사건 종료까지의 상태와 증거 요건을 정의했습니다.
비공개 신고 감사 프로브 scripts/lib/private-vulnerability-reporting-audit.mjs, scripts/private-vulnerability-reporting-audit.mjs, docs/security/private-vulnerability-reporting-audit.md, test/private-vulnerability-reporting-adapter.test.ts, test/private-vulnerability-reporting-audit.test.ts	허용된 저장소의 canonical GitHub API URL과 enabled 응답을 검증합니다. 응답 크기, UTF-8, JSON, HTTP 상태 및 20초 시간 제한을 검사합니다. 결과를 JSON 파일과 표준 출력으로 기록하고 PASS가 아니면 종료 코드 1을 반환합니다. 런북과 테스트는 읽기 전용 요청, 실패 조건, 결과 한계 및 증거 요건을 검증합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant 운영자
  participant 감사스크립트
  participant GitHubAPI
  participant 감사보고서
  운영자->>감사스크립트: 저장소와 출력 경로 지정
  감사스크립트->>GitHubAPI: 비공개 신고 상태 GET 요청
  GitHubAPI-->>감사스크립트: JSON enabled 응답
  감사스크립트->>감사스크립트: 응답 및 상태 평가
  감사스크립트->>감사보고서: PASS 또는 FAIL 결과 저장
  감사스크립트-->>운영자: 결과 출력 및 종료 코드 반환

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 nanoid 이후 조정된 취약점 공개 정책을 재적용하는 주요 변경 사항을 명확하고 간결하게 설명합니다.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/coordinated-vulnerability-disclosure-on-main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/private-vulnerability-reporting-adapter.test.ts`:
- Around line 42-47: Strengthen the oversized-response test around
readBoundedJson by making streamedResponse’s body access or getReader invocation
fail, or by asserting it is never invoked. Preserve the existing size-limit
rejection assertion while verifying that a response exceeding Content-Length is
rejected before any body access.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fa4596dd-b6f4-4e44-9e34-64dee60507a5

📥 Commits

Reviewing files that changed from the base of the PR and between c85d710 and 525aea3.

📒 Files selected for processing (10)

• CHANGELOG.md
• SECURITY.md
• docs/doctoring/vulnerability-disclosure.md
• docs/security/private-vulnerability-reporting-audit.md
• docs/security/vulnerability-handling.md
• scripts/lib/private-vulnerability-reporting-audit.mjs
• scripts/private-vulnerability-reporting-audit.mjs
• test/private-vulnerability-reporting-adapter.test.ts
• test/private-vulnerability-reporting-audit.test.ts
• test/security-policy-contract.test.ts