Skip to content

docs(security): point reporters at the now-enabled private advisory form #699

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lidge-jun merged 1 commit into from
Jul 29, 2026
Merged

docs(security): point reporters at the now-enabled private advisory form #699

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/ISSUE_TEMPLATE/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
blank_issues_enabled: false
contact_links:
- name: Report a security vulnerability (private)
url: https://github.com/lidge-jun/opencodex/security/advisories/new
about: Report undisclosed vulnerabilities privately to the maintainers. Do not open a public issue.
- name: Security policy
url: https://github.com/lidge-jun/opencodex/blob/main/SECURITY.md
about: Read the supported-version and reporting guidance before sharing security-sensitive details.
Expand Down
3 changes: 3 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -509,6 +509,9 @@ The public docs — install, providers, routing, sidecars, Codex integration, Co
Maintainer source-of-truth notes live under [`structure/`](./structure). Historical investigations remain under [`docs/`](./docs).
Contributor setup lives in [`CONTRIBUTING.md`](./CONTRIBUTING.md), and security reporting guidance
lives in [`SECURITY.md`](./SECURITY.md).
Report undisclosed vulnerabilities privately through
[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
not a public issue.
Comment on lines +512 to +514

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Document the unreachable-form fallback here too.

This wording unconditionally says “not a public issue,” but SECURITY.md Lines 31-32 correctly permits a minimal public coordination issue when the advisory form is unreachable. Without that exception, README-only readers have no safe next step if the private form cannot be accessed.

Proposed clarification 
 Report undisclosed vulnerabilities privately through
 [GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
-not a public issue.
+not a public issue. If the form is unreachable, open a minimal public issue requesting a safe
+coordination path without including exploit details, secrets, or live targets.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
Report undisclosed vulnerabilities privately through
[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
not a public issue.
Report undisclosed vulnerabilities privately through
[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
not a public issue. If the form is unreachable, open a minimal public issue requesting a safe
coordination path without including exploit details, secrets, or live targets.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 512 - 514, Update the README security-reporting
guidance to include the same fallback as SECURITY.md: if GitHub private
vulnerability reporting is unreachable, allow opening a minimal public
coordination issue without disclosing vulnerability details. Keep the private
reporting recommendation as the primary path.


## Development

Expand Down
18 changes: 12 additions & 6 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,13 +17,19 @@ or the latest published package before triage continues.

Please avoid posting undisclosed vulnerabilities as public GitHub issues.

- Prefer this repository's GitHub private vulnerability reporting or GitHub Security Advisory flow
when that option is available in the repository UI.
- If no private reporting option is available, do not include exploit details, secrets, or live
targets in a public issue. Open a minimal issue that asks maintainers for a safe coordination path.
- Include affected versions, reproduction steps, impact, and any required configuration details.
Report privately through GitHub private vulnerability reporting, which is enabled on this
repository:

The project does not publish a dedicated private security email in this repository.
**<https://github.com/lidge-jun/opencodex/security/advisories/new>**

The same form is reachable from the repository's **Security** tab under **Report a vulnerability**.
It is private between you and the maintainers, and it is the only channel this project offers for
undisclosed vulnerabilities — there is no dedicated private security email.

Include affected versions, reproduction steps, impact, and any required configuration details.

If the form is ever unreachable for you, open a minimal public issue that asks maintainers for a
safe coordination path. Do not include exploit details, secrets, or live targets in that issue.

## Response Expectations

Expand Down
Loading