docs: replace placeholder security policy with a real one - #36
Merged
Conversation
SECURITY.md was unmodified GitHub boilerplate. Three problems, in
descending order of severity.
Reports were directed to security@example.com. example.com is IANA's
reserved documentation domain and accepts no mail, so anyone following
the policy sent their report nowhere. Private vulnerability reporting is
already enabled on this repo, so that is now the documented channel — no
mailbox to monitor and no personal address published.
The supported-versions table listed 5.1.x, 5.0.x and 4.0.x. None of those
exist. This is a continuously deployed static site; the only supported
thing is what is currently live from main.
The template's own instruction text ("Use this section to tell people
about...") was still in the file.
Scope is now written for what this actually is: a Next.js static export on
GitHub Pages with no backend. That rules out server-side classes of
report, and rules out documentation typos and already-advisory'd
dependency CVEs that Dependabot handles.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SECURITY.mdwas unmodified GitHub boilerplate. Found while adding a policy tosecurity-news, which had none.The actual problem
Reports were directed to
security@example.com.example.comis IANA's reserved documentation domain (RFC 2606) and accepts no mail — so anyone who followed the policy sent their vulnerability report into a black hole, and would have had no reason to think it hadn't arrived.Two lesser issues alongside it:
package.jsonsays1.0.0and the tags are1.0.0,2.0.0,legacy,rtd-theme,16042022.What replaces it
Reporting channel: GitHub private vulnerability reporting, which is already enabled on this repo. No mailbox to monitor, and no personal address published.
Supported versions: only the live site built from
main. No backports, and tags stated as historical markers rather than releases.Scope: written for a Next.js static export on GitHub Pages with no backend —
app/,components/,lib/, the build config, thepatches/applied at install time, and the workflows' permissions and publish paths.Ruled out explicitly, so triage isn't spent on them: documentation typos and inaccuracies, dependency CVEs that already have a public advisory (Dependabot handles those), findings that assume server-side behaviour this site doesn't have or headers GitHub Pages won't let us set, and scanner output with no demonstrated impact.
Documentation only — no code, workflow or dependency changes.
Companion PR: libre-devops/security-news#3