From 538369576f6c147cd55a468a158bcb0b4cb2f3d6 Mon Sep 17 00:00:00 2001
From: Craig Thacker <craigthackerx@gmail.com>
Date: Sat, 8 Aug 2026 09:44:29 +0100
Subject: [PATCH] docs: add security policy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The repo had no SECURITY.md. Private vulnerability reporting is already
enabled, so this documents that channel rather than introducing an email
address that would need monitoring.

Scope is written for what this project actually is: a static aggregator
with no backend, where the interesting attack surface is untrusted
upstream feed content reaching the browser or the build. Article content
itself is explicitly out of scope and directed to the originating vendor,
as is anything Dependabot already tracks.

Supported versions reflects reality — the deployed site from master, with
no backports. Tags here are historical markers, not releases.
---
 SECURITY.md | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..097b8c0
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,73 @@
+# Security Policy
+
+## Supported Versions
+
+Only the currently deployed site, built from `master` and published to
+https://security.libredevops.org, receives security updates.
+
+Tags in this repository are historical markers rather than supported releases.
+There is no backport process: fixes land on `master` and reach the live site on
+the next deployment.
+
+## Scope
+
+Security News is a static site with no backend, no accounts and no server-side
+request handling. Feeds are ingested by a scheduled GitHub Actions run and the
+result is published to GitHub Pages.
+
+In scope:
+
+- The feed ingestion script (`scripts/fetch_feeds.py`) and its dependencies
+  (`scripts/requirements.txt`).
+- The front end: `index.html`, `js/`, `css/`, and the service worker (`sw.js`).
+- The generated artefacts in `data/` (`feeds.json`, `feed.xml`), including
+  injection or escaping issues arising from untrusted upstream feed content.
+- The workflows in `.github/workflows/`, including their permissions and any
+  path allowing an untrusted input to influence a commit or deployment.
+- The deployed site and feed at https://security.libredevops.org.
+
+Out of scope:
+
+- The content of aggregated articles and the upstream vendor feeds themselves.
+  Report those to the originating vendor — this project only republishes them.
+- Inaccurate, missing, stale or miscategorised articles. These are correctness
+  bugs, not vulnerabilities; raise a normal issue.
+- Vulnerabilities in third-party dependencies that already carry a public
+  advisory. Dependabot tracks those automatically, so a report adds nothing.
+
+Because this project aggregates security content, a plausible finding is one
+where hostile upstream feed content reaches a viewer's browser or influences the
+build — stored XSS through an article title or summary, HTML or XML injection
+into `feed.xml`, service worker cache poisoning, or a workflow that can be
+steered by feed data.
+
+## Reporting a Vulnerability
+
+Report privately using GitHub's private vulnerability reporting:
+
+**https://github.com/libre-devops/security-news/security/advisories/new**
+
+Do **not** open a public issue for an undisclosed vulnerability.
+
+Please include:
+
+- The affected component and, where relevant, the commit or deployment date.
+- Reproduction steps, ideally with the specific feed entry or payload involved.
+- The impact you believe it has.
+- Any suggested remediation, if you have one.
+
+## What to Expect
+
+- Acknowledgement of receipt within **3 business days**.
+- An initial triage decision within **7 business days**.
+
+If the report is accepted, we will develop a fix and coordinate disclosure
+timing with you once a patch or mitigation is deployed. If it is declined, we
+will tell you why — for example not reproducible, out of scope as described
+above, or already publicly known.
+
+Please hold off on public disclosure until remediation is complete. This is a
+volunteer-maintained project, so please be reasonable about timelines.
+
+Published advisories:
+**https://github.com/libre-devops/security-news/security/advisories**