Skip to content

Security: gleanwork/sl-glean-sites

Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Please do not report security vulnerabilities through public GitHub issues.

If you believe you found a vulnerability in this example, contact Glean Support at support@glean.com and include:

  • A description of the issue
  • Steps to reproduce
  • Any affected deployment configuration
  • Whether any credentials, customer data, or Glean data may have been exposed

Secret Handling

This repository must remain public-safe.

Do not commit:

  • Glean API keys, OAuth tokens, or refresh tokens
  • OAuth client secrets
  • AWS access keys or session tokens
  • Customer-specific Glean instance names, Agent IDs, backend URLs, or app domains
  • Customer data, identity maps, saved Site output, or admin email lists

Use environment variables outside source control, AWS Secrets Manager, deployment-time configuration, or a customer's own secret-management process for deployment-specific values.

Deployment Security

Glean Sites is a customer-deployable example. Review the generated AWS resources, OAuth configuration, admin allowlist, CORS settings, and WAF rules against your organization's requirements before production use.

For dependency updates, use the repository's CI checks and Dependabot alerts where available.

There aren't any published security advisories