Repository navigation
Add an organisation wide security policy - #2
Merged
Merged
Conversation
Our repositories had no way for someone to report a vulnerability privately. Private vulnerability reporting was disabled and no SECURITY.md existed, so a researcher's only option was a public issue, which is the opposite of what you want. Private reporting is now enabled on the five Django packages, and this gives it a documented front door. GitHub serves this file to every repository in the organisation that has no policy of its own, so it is written once rather than copied. The response commitment is deliberately modest. A week to acknowledge is something a small team can keep; a 24 hour promise is not, and a policy nobody can meet is worse than none. The last section matches the AI assistance policy in CONTRIBUTING.md: disclosure is asked for, reproducibility is required either way. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
None of our repositories had a way to report a vulnerability privately. Private vulnerability reporting was disabled and there was no
SECURITY.mdanywhere, so a researcher's only route was a public issue. That is the actual disclosure risk, and it is now closed: private reporting is enabled on all five Django packages, and this file gives it a documented front door.As with the pull request template in #1, GitHub serves this to every repository in the organisation that has no policy of its own, so it is written once instead of copied into each repo.
Three things worth a look:
The response commitment is deliberately modest. A week to acknowledge is something a small team can actually keep. A 24 hour promise would be a policy nobody can meet, which is worse than no policy.
The scope section says what is out of scope as well as in, because most of the noise in small-project security inboxes is upstream issues and scanner output with no demonstrated impact.
The last section matches the AI assistance policy already in
CONTRIBUTING.md: disclosure is requested, and reproducibility is required either way. This is the part that keeps AI generated report volume from costing maintainer time, which is the problem curl has written about at length.[email protected]is named as a fallback for anyone who cannot reach the GitHub form. Change or drop that line if it is not a monitored address.AI assistance
Yes. Written with Claude Code, as the trailer on the commit records.
🤖 Generated with Claude Code