|
| 1 | +# Public Security Policy PR |
| 2 | + |
| 3 | +Status: candidate |
| 4 | + |
| 5 | +Use this workflow when a large public repository has no visible `SECURITY.md`, but already has or can safely use a private vulnerability reporting channel such as GitHub Security Advisories. |
| 6 | + |
| 7 | +## Trigger |
| 8 | + |
| 9 | +Good fits: |
| 10 | + |
| 11 | +- a public issue explicitly asks for a missing security policy |
| 12 | +- GitHub metadata shows no enabled security policy |
| 13 | +- the repository already exposes a private advisory/contact path |
| 14 | +- the change can be documentation-only and bounded |
| 15 | + |
| 16 | +Do not use this to disclose vulnerability details, request private access, or invent a security response process for maintainers. |
| 17 | + |
| 18 | +## Inputs |
| 19 | + |
| 20 | +- Public repository URL. |
| 21 | +- Public issue requesting a security policy, if present. |
| 22 | +- Existing private vulnerability reporting path. |
| 23 | +- Repository default branch and documentation conventions. |
| 24 | + |
| 25 | +Never include credentials, private reports, exploit details, or confidential vulnerability material. |
| 26 | + |
| 27 | +## Workflow |
| 28 | + |
| 29 | +1. Confirm neither `SECURITY.md` nor `.github/SECURITY.md` exists. |
| 30 | +2. Confirm the repository's private vulnerability reporting path from public metadata or docs. |
| 31 | +3. Add a concise `SECURITY.md` that points reporters to the private channel. |
| 32 | +4. Warn reporters not to disclose vulnerabilities in public issues, discussions, or pull requests. |
| 33 | +5. Keep scope to reporting guidance, disclosure etiquette, and update guidance. |
| 34 | +6. Avoid unsupported claims about SLAs, bounties, supported versions, or guaranteed security response. |
| 35 | +7. Open a small PR that references the source issue and states that no sensitive details are included. |
| 36 | + |
| 37 | +## Validation |
| 38 | + |
| 39 | +```bash |
| 40 | +git diff --check |
| 41 | +gh api repos/OWNER/REPO/contents/SECURITY.md |
| 42 | +gh api repos/OWNER/REPO/contents/.github/SECURITY.md |
| 43 | +gh repo view OWNER/REPO --json isSecurityPolicyEnabled,contactLinks |
| 44 | +``` |
| 45 | + |
| 46 | +Expected checks: |
| 47 | + |
| 48 | +- existing policy paths return 404 before the PR |
| 49 | +- private reporting channel is verified from public metadata |
| 50 | +- PR body contains no payment link, credentials, private data, or vulnerability details |
| 51 | +- docs-only diff is small enough for maintainer review |
| 52 | + |
| 53 | +## Failure Modes |
| 54 | + |
| 55 | +Stop or revise when: |
| 56 | + |
| 57 | +- no official private reporting channel is visible |
| 58 | +- a policy already exists in the repo or shared org `.github` repository |
| 59 | +- the proposed text claims unsupported SLA, bounty, or version support |
| 60 | +- the PR would expose vulnerability details or encourage public disclosure |
| 61 | +- the repository asks security reports to use a different official channel |
| 62 | + |
| 63 | +## Evidence |
| 64 | + |
| 65 | +This candidate is based on a merged documentation PR in `langgenius/dify`: |
| 66 | + |
| 67 | +- Source issue: https://github.com/langgenius/dify/issues/36692 |
| 68 | +- Merged PR: https://github.com/langgenius/dify/pull/36873 |
| 69 | +- Result: maintainer approved and merged the bounded `SECURITY.md` addition. |
0 commit comments