Repository navigation
Docs: add SECURITY.md and CONTRIBUTING.md - #256
Merged
Merged
Conversation
SECURITY.md: private reporting through GitHub's private vulnerability reporting, a split between bindings and engine reports (engine goes to the ArcadeData/arcadedb advisories), supported versions and the A.B.C, A.B.C.devN, A.B.C.postN numbering, what to include, what happens next. Structure and tone follow the upstream file; no response times are promised. CONTRIBUTING.md: licence, where a bug belongs, setup with uv only (the repository is not a uv project, so tests run from the built wheel with uv run --no-project), build and test of arcadedb-jvm and arcadedb (native) as the docs and workflows do, pre-commit and Bandit, workflow, timed A/B for performance changes, docs, releases. Links to docs/ pages instead of repeating them. Closes #255 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tae898
added a commit
that referenced
this pull request
Nov 5, 2026
…write) (#260) The workflow from #252 failed on the merges of #252 and #256 with 403 Resource not accessible by integration when it set the pull request's milestone; issues: write covers issues only. The workflow still checks out no pull request code (pull_request_target), so the wider token stays safe. Closes #259 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #255
Adds
SECURITY.mdandCONTRIBUTING.md, modelled on the files of ArcadeData/arcadedb. Nothing else changes.SECURITY.mdkeeps upstream's structure (reporting, what to include, supported versions, my response, disclosure and credit, scope). Reports go through GitHub's private vulnerability reporting of this repository, never a public issue. A vulnerability in the engine itself (server, SQL, wire protocols, storage) goes to the private advisories of ArcadeData/arcadedb, as itsSECURITY.mdsays. The supported version is the latest release ofarcadedbandarcadedb-jvm, with theA.B.C,A.B.C.devNandA.B.C.postNnumbering explained and linked torelease.adoc. Upstream promises acknowledgement within 3 business days, an assessment within 10 and updates every 14; this file promises no times, because this repository has not agreed on any.CONTRIBUTING.mdis short and links todocs/instead of repeating it: the licence, where a bug belongs (engine bugs go upstream), setup with uv only, build and test of both packages, test rules, pre-commit and Bandit, the issue, branch andCloses #Nworkflow, the timed A/B for performance changes, docs, and releases.Assumption for maintainers: the security policy assumes private vulnerability reporting is enabled for this repository. That is a repository setting (Settings, Code security, Private vulnerability reporting) that a maintainer turns on; this PR does not change it. Until it is on, the "Report a vulnerability" link in
SECURITY.mdhas nothing behind it.Note on repository setup: this repository is not a uv project (
pyproject.tomlsetsmanaged = false), soCONTRIBUTING.mddoes not sayuv sync. It usesuv run --no-project --with "$W[test]" python -m pytest, asCLAUDE.mddoes. It also mentions the pull request template (.github/pull_request_template.md) anduvx pre-commit run --files <changed files>, which come from #252; merge #252 first, or reword that one paragraph if #252 changes.How it was checked:
uvx pre-commit run --files SECURITY.md CONTRIBUTING.mdrun twice: nothing reformatted, the hooks that apply passed (the others had no files to check).pip installand the em dash over both files finds nothing.CONTRIBUTING.md(scripts/build.sh,ARCADEDB_TAG,--reinstall-package arcadedb-jvm, theuv run --no-projecttest lines, Bandit, the Antora build,build-image.sh,build_wheel.py --lib-dir, the parity suite step) was found with grep inREADME.md,CLAUDE.md, a workflow or a script of this repository.🤖 Generated with Claude Code