From d0763bf78b3ea223db0a166c3f81f05c1fe5afc0 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Wed, 29 Jul 2026 19:08:38 +0900 Subject: [PATCH] docs(security): point reporters at the now-enabled private advisory form Private vulnerability reporting was disabled on the repository, but SECURITY.md told reporters to prefer it "when that option is available in the repository UI" and stated no private security email exists. Every private channel it named was therefore unreachable, leaving a public issue as the only route for undisclosed vulnerabilities. Private vulnerability reporting is now enabled. Replace the conditional wording with the direct advisory URL, keep the minimal-public-issue text as a fallback rather than the default, and surface the same link from the issue-template chooser and README. --- .github/ISSUE_TEMPLATE/config.yml | 3 +++ README.md | 3 +++ SECURITY.md | 18 ++++++++++++------ 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index d85f47ee5..07fd1d1cf 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,5 +1,8 @@ blank_issues_enabled: false contact_links: + - name: Report a security vulnerability (private) + url: https://github.com/lidge-jun/opencodex/security/advisories/new + about: Report undisclosed vulnerabilities privately to the maintainers. Do not open a public issue. - name: Security policy url: https://github.com/lidge-jun/opencodex/blob/main/SECURITY.md about: Read the supported-version and reporting guidance before sharing security-sensitive details. diff --git a/README.md b/README.md index cd8d98074..86b30f082 100644 --- a/README.md +++ b/README.md @@ -509,6 +509,9 @@ The public docs — install, providers, routing, sidecars, Codex integration, Co Maintainer source-of-truth notes live under [`structure/`](./structure). Historical investigations remain under [`docs/`](./docs). Contributor setup lives in [`CONTRIBUTING.md`](./CONTRIBUTING.md), and security reporting guidance lives in [`SECURITY.md`](./SECURITY.md). +Report undisclosed vulnerabilities privately through +[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new), +not a public issue. ## Development diff --git a/SECURITY.md b/SECURITY.md index a9802c920..b39af65d2 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -17,13 +17,19 @@ or the latest published package before triage continues. Please avoid posting undisclosed vulnerabilities as public GitHub issues. -- Prefer this repository's GitHub private vulnerability reporting or GitHub Security Advisory flow - when that option is available in the repository UI. -- If no private reporting option is available, do not include exploit details, secrets, or live - targets in a public issue. Open a minimal issue that asks maintainers for a safe coordination path. -- Include affected versions, reproduction steps, impact, and any required configuration details. +Report privately through GitHub private vulnerability reporting, which is enabled on this +repository: -The project does not publish a dedicated private security email in this repository. +**** + +The same form is reachable from the repository's **Security** tab under **Report a vulnerability**. +It is private between you and the maintainers, and it is the only channel this project offers for +undisclosed vulnerabilities — there is no dedicated private security email. + +Include affected versions, reproduction steps, impact, and any required configuration details. + +If the form is ever unreachable for you, open a minimal public issue that asks maintainers for a +safe coordination path. Do not include exploit details, secrets, or live targets in that issue. ## Response Expectations