chore: add SECURITY.md (private vulnerability reporting policy)#591
Merged
Conversation
Adds a draft security policy modeled on GitHub's 'Suggest a security policy' workflow. The most important part is documenting a private reporting channel so researchers can responsibly disclose findings. Maintainers should feel free to edit any section.
Collaborator
|
Great |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a repository-level security policy document (SECURITY.md) to enable/encourage responsible disclosure via private channels, aligning the repo with GitHub’s “Suggest a security policy” workflow and supporting Private Vulnerability Reporting (PVR).
Changes:
- Add a new
SECURITY.mddescribing how to report vulnerabilities (PVR + email fallback). - Document what details to include in a report, plus scope/out-of-scope examples.
- Define a suggested disclosure process and optional recognition section.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+50
to
+53
| 1. A maintainer will acknowledge receipt within roughly 1 week. | ||
| 2. We'll triage the report: confirm severity, scope, and reproducibility. | ||
| 3. We'll work with you on a fix and a coordinated disclosure timeline (typically up to 90 days, longer if the fix is structural). | ||
| 4. On publication, we credit you in the advisory unless you ask not to be credited. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
dynamic-tp currently has no
SECURITY.md. GitHub's Security tab shows the "Suggest a security policy" prompt for exactly this case. This PR is that suggestion.What
Adds a draft
SECURITY.mdat the repo root, modelled on GitHub's standard template with sections tailored for a runtime thread-pool / config-center / notification framework (so the in-scope list highlights notifier SSRF, deserialization in config-loaders, etc.).The most important part is documenting a private reporting channel so security researchers can responsibly disclose findings without having to choose between staying silent and posting to a public issue. The draft points at GitHub's Private Vulnerability Reporting (PVR) feature as the preferred channel, with an email fallback that maintainers can fill in.
Suggested action by maintainers after merge:
SECURITY.mdto point at the maintainer's preferred address.Sections in the draft:
Maintainers should feel free to edit any section — the important thing is that a private channel exists.
Companion issue
See #590 for the request to enable PVR. This PR is the
SECURITY.mdhalf; merging this and enabling PVR together unblocks structured private disclosure.Thanks for considering!