From 77a224b02f2972b880abadcfa94ad6b092678352 Mon Sep 17 00:00:00 2001 From: Craig Thacker Date: Sat, 8 Aug 2026 09:45:34 +0100 Subject: [PATCH] docs: replace placeholder security policy with a real one MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SECURITY.md was unmodified GitHub boilerplate. Three problems, in descending order of severity. Reports were directed to security@example.com. example.com is IANA's reserved documentation domain and accepts no mail, so anyone following the policy sent their report nowhere. Private vulnerability reporting is already enabled on this repo, so that is now the documented channel — no mailbox to monitor and no personal address published. The supported-versions table listed 5.1.x, 5.0.x and 4.0.x. None of those exist. This is a continuously deployed static site; the only supported thing is what is currently live from main. The template's own instruction text ("Use this section to tell people about...") was still in the file. Scope is now written for what this actually is: a Next.js static export on GitHub Pages with no backend. That rules out server-side classes of report, and rules out documentation typos and already-advisory'd dependency CVEs that Dependabot handles. --- SECURITY.md | 78 ++++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 21 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index ae2fd8f..7366537 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,34 +2,70 @@ ## Supported Versions -Use this section to tell people about which versions of your project are -currently being supported with security updates. +Only the currently deployed site, built from `main` and published to +https://libredevops.org, receives security updates. -| Version | Supported | -| ------- | ------------------ | -| 5.1.x | :white_check_mark: | -| 5.0.x | :x: | -| 4.0.x | :white_check_mark: | -| < 4.0 | :x: | +Tags in this repository are historical markers rather than supported releases. +There is no backport process: fixes land on `main` and reach the live site on +the next deployment. + +## Scope + +This repository builds libredevops.org — a Next.js site exported as static +files and served by GitHub Pages. There is no backend, no accounts and no +server-side request handling, so anything requiring a server-side flaw does not +apply here. + +In scope: + +- The application source: `app/`, `components/`, `lib/`, `mdx-components.tsx` + and `theme.config.tsx`. +- Build configuration that affects what ships: `next.config.mjs`, and the + `patches/` applied by `patch-package` at install time. +- The workflows in `.github/workflows/`, including their permissions and any + path that would let an untrusted input publish to the live site. +- Dependency issues that reach the built output and do not already have a + public advisory. +- The deployed site at https://libredevops.org. + +Out of scope: + +- Typos, broken links, inaccurate or outdated guidance in the documentation + content. These are correctness bugs — raise a normal issue. +- Vulnerabilities in third-party dependencies that already carry a public + advisory. Dependabot tracks those automatically, so a report adds nothing. +- Findings that depend on a server-side behaviour this site does not have, or + on missing headers that GitHub Pages does not let us set. +- Reports produced by running a scanner against the live site with no + demonstrated impact. ## Reporting a Vulnerability -Please report suspected vulnerabilities privately by email to **security@example.com**. -Do **not** open public GitHub issues for undisclosed security reports. +Report privately using GitHub's private vulnerability reporting: + +**https://github.com/libre-devops/libredevops-dot-org/security/advisories/new** + +Do **not** open a public issue for an undisclosed vulnerability. + +Please include: + +- The affected component and, where relevant, the commit or deployment date. +- Reproduction steps. +- The impact you believe it has. +- Any suggested remediation, if you have one. -Include the affected version(s), reproduction steps, impact assessment, and any proposed -remediation details in your report. +## What to Expect -We will acknowledge receipt within **3 business days** and provide an initial -triage update within **7 business days**. +- Acknowledgement of receipt within **3 business days**. +- An initial triage decision within **7 business days**. -If the report is accepted, we will work on a fix and coordinate disclosure with -you after a patch or mitigation is available. If the report is declined, we will -share the reason (for example, unsupported version, non-security issue, or not -reproducible with provided details). +If the report is accepted, we will develop a fix and coordinate disclosure +timing with you once a patch or mitigation is deployed. If it is declined, we +will tell you why — for example not reproducible, out of scope as described +above, or already publicly known. -Please do **not** disclose vulnerabilities publicly until we have completed -investigation and remediation coordination. +Please hold off on public disclosure until remediation is complete. This is a +volunteer-maintained project, so please be reasonable about timelines. -Security advisories and fixes will be published at: +Published advisories: **https://github.com/libre-devops/libredevops-dot-org/security/advisories**