chore(security): rewrite SECURITY.md with SOC2-ready policy#762
Merged
Conversation
anandray
requested review from
Rod-Christensen,
jmaionchi and
stepmikhaylov
as code owners
Contributor
|
Caution Review failedPull request was closed or merged during review Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughSECURITY.md was reworked to expand supported-versions guidance, replace SLA bullets with a triage/remediation SLA table, document GitHub-native scanning and alert dismissal flows, standardize triage dispositions, and add develop branch protection, quarterly access reviews, and public disclosure rules. ChangesSECURITY Policy Update
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
No description provided. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SECURITY.md`:
- Around line 9-10: Replace the single-person contact in the SECURITY.md
vulnerability intake section by adding a shared, monitored alias and at least
one backup/escalation mailbox; update the existing "**Email:**
anand.ray@rocketride.ai" line to include a team alias (e.g.,
security@rocketride.ai) and append an "Escalation / Backup" line listing
secondary contacts or rotation procedures, and ensure the "**GitHub Private
Vulnerability Reporting:**" entry references the same monitored alias or
documents the escalation path so intake isn't dependent on one individual.
- Around line 50-51: Replace brittle hard-coded CI check names and fixed
schedule text (e.g., "CI OK", "Analyze (python)", "Analyze
(javascript-typescript)", and the cadence/force-push wording) with a policy
statement referencing "required checks configured in branch protection" and
"security scans configured in GitHub Actions"; remove specific job
names/schedules from SECURITY.md and add a note that exact job names and scan
cadence belong in the operational runbook so audits reference the canonical
config there.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9b0d9a57-942b-43f4-9c3e-d6331a77e433
📒 Files selected for processing (1)
SECURITY.md
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
SECURITY.md (1)
9-10:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAvoid single-person vulnerability intake dependency.
The primary email path still depends on one individual mailbox, which is a continuity risk for security intake. Add a shared monitored alias and explicit backup/escalation contact in this policy.
Proposed doc update
-- **Email:** anand.ray@rocketride.ai +- **Email:** security@rocketride.ai (monitored shared mailbox) +- **Escalation / Backup:** anand.ray@rocketride.ai (until shared mailbox migration is complete)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` around lines 9 - 10, Replace the single-person contact in the SECURITY.md entry that currently shows "**Email:** anand.ray@rocketride.ai" with a shared, monitored alias (e.g., security@rocketride.ai) and add an explicit backup/escalation contact line (e.g., "**Escalation contact:** security-lead@rocketride.ai or PagerDuty/rotation details") next to or below the existing "**GitHub Private Vulnerability Reporting:**" entry; ensure the text also notes monitoring/SLAs for the alias and that the original personal mailbox is listed only as a secondary/backup contact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SECURITY.md`:
- Around line 14-25: The intake sentence ("We aim to acknowledge reports within
2 business days and provide a triage decision within 5 business days") conflicts
with the severity-specific triage SLAs in the "Triage and Remediation SLA" table
(e.g., Critical = 1 business day); update SECURITY.md to remove ambiguity by
replacing the generic "provide a triage decision within 5 business days" with a
sentence that defers to the table (e.g., "we aim to provide a triage decision
within the timeframes specified in the Triage and Remediation SLA table below"),
or conversely adjust the table to match a single 5-business-day intake
policy—ensure the intake line explicitly references the table and keep the table
rows (Critical/High/Medium/Low) consistent with that choice so auditors can
unambiguously determine applicable triage SLAs.
- Line 46: Update the sentence that refers to GitHub to use the canonical
capitalization "GitHub" (capital G and H) instead of any other casing; locate
the line containing "Tool configuration, cadence, and exact workflow names are
maintained in `.github/workflows/` and the repository's security settings —
refer to those as the source of truth." and change the product name to "GitHub"
for consistency with official naming.
---
Duplicate comments:
In `@SECURITY.md`:
- Around line 9-10: Replace the single-person contact in the SECURITY.md entry
that currently shows "**Email:** anand.ray@rocketride.ai" with a shared,
monitored alias (e.g., security@rocketride.ai) and add an explicit
backup/escalation contact line (e.g., "**Escalation contact:**
security-lead@rocketride.ai or PagerDuty/rotation details") next to or below the
existing "**GitHub Private Vulnerability Reporting:**" entry; ensure the text
also notes monitoring/SLAs for the alias and that the original personal mailbox
is listed only as a secondary/backup contact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 65f11f34-efb7-43be-9a70-253c0d62366c
📒 Files selected for processing (1)
SECURITY.md
ryan-t-christensen
previously approved these changes
May 6, 2026
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (2)
SECURITY.md (2)
46-46:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winGitHub capitalization still needs correction.
Line 46 should use "GitHub security settings" (capital H) for consistency with official product naming in compliance documentation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` at line 46, Update the phrase in SECURITY.md that currently reads "the repository's security settings" to "the repository's GitHub security settings" so "GitHub" is capitalized; locate the sentence containing ".github/workflows/ and the repository's security settings" and replace it with ".github/workflows/ and the repository's GitHub security settings" to ensure consistent official product naming.
9-10:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSingle-person vulnerability intake channel remains unresolved.
The individual mailbox (anand.ray@rocketride.ai) creates a continuity risk for SOC2 security incident intake. The PR description acknowledges this is temporary pending a shared mailbox, but the policy should not go live for audit evidence until a monitored team alias or backup escalation path is in place.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` around lines 9 - 10, Replace the single-person intake address "anand.ray@rocketride.ai" with a monitored team alias and add a backup escalation path in the SECURITY.md contact section; update the "GitHub Private Vulnerability Reporting" note to reference the team mailbox (or both the team alias and the individual as secondary) and document the alternate escalation contact and monitoring details so the policy shows a shared, monitored channel and a backup for SOC2 evidence.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@SECURITY.md`:
- Line 46: Update the phrase in SECURITY.md that currently reads "the
repository's security settings" to "the repository's GitHub security settings"
so "GitHub" is capitalized; locate the sentence containing ".github/workflows/
and the repository's security settings" and replace it with ".github/workflows/
and the repository's GitHub security settings" to ensure consistent official
product naming.
- Around line 9-10: Replace the single-person intake address
"anand.ray@rocketride.ai" with a monitored team alias and add a backup
escalation path in the SECURITY.md contact section; update the "GitHub Private
Vulnerability Reporting" note to reference the team mailbox (or both the team
alias and the individual as secondary) and document the alternate escalation
contact and monitoring details so the policy shows a shared, monitored channel
and a backup for SOC2 evidence.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: beb1c5f9-7635-4dc9-bb9c-b81280596105
📒 Files selected for processing (1)
SECURITY.md
anandray
added a commit
that referenced
this pull request
May 11, 2026
Resolves merge conflict with develop (where PR #800 landed the "Vulnerability & Alert Triage" section with the two-person Delegated Alert Dismissal flow). This commit replays #762's original intent on top of current develop and integrates with what merged: Additions on top of develop's current SECURITY.md: - Scanning Tools and Coverage subsection — lists CodeQL (Python, JS/TS, C/C++ via Default Setup), Scorecard, Trivy, Dependabot, Secret Scanning + Push Protection. Defers to .github/workflows and repo settings as source of truth. - Branch Protection (`develop`) section — code-owner approval, required checks, force-push/branch-deletion disallowed, linear history, stale reviews dismissed, admin bypass disabled. - Access Reviews section — quarterly review of org members, outside collaborators, owners, and 2FA compliance. - Public Vulnerability Disclosure section — advisory publication policy. - Triage and Remediation SLA table — business days for triage, calendar days for remediation; replaces the prose SLA list. - "Critical-severity issues in unsupported versions evaluated case-by-case" note on Supported Versions. Adjustments to existing develop content: - Triage Disposition naming: "Fix" → "Fixed", "Won't fix" → "Accepted risk" (the latter now requires named approver, rationale, AND a re-evaluation date — the additional SOC2 hygiene #762 introduced). - "Initial Assessment: within 5 business days" prose dropped — the new SLA table covers triage timing more rigorously. Reporting email stays `security@rocketride.ai` (mailbox now exists, per the SOC2 follow-up). Refs #760 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
anandray
force-pushed
the
develop-security-soc2-05052026
branch
from
370fc28 to
7893224
Compare
Contributor
Author
|
Conflict resolved. Force-pushed What's preserved from #800 (already on develop):
What this PR now adds on top:
Naming reconciliation in the Triage Dispositions table:
Reporting email: stays CodeRabbit will re-review on the new SHA. |
Resolves merge conflict with develop (where PR #800 landed the "Vulnerability & Alert Triage" section with the two-person Delegated Alert Dismissal flow). This commit replays #762's original intent on top of current develop and integrates with what merged: Additions on top of develop's current SECURITY.md: - Scanning Tools and Coverage subsection — lists CodeQL (Python, JS/TS, C/C++ via Default Setup), Scorecard, Trivy, Dependabot, Secret Scanning + Push Protection. Defers to .github/workflows and repo settings as source of truth. - Branch Protection (`develop`) section — code-owner approval, required checks, force-push/branch-deletion disallowed, linear history, stale reviews dismissed, admin bypass disabled. - Access Reviews section — quarterly review of org members, outside collaborators, owners, and 2FA compliance. - Public Vulnerability Disclosure section — advisory publication policy. - Triage and Remediation SLA table — business days for triage, calendar days for remediation; replaces the prose SLA list. - "Critical-severity issues in unsupported versions evaluated case-by-case" note on Supported Versions. Adjustments to existing develop content: - Triage Disposition naming: "Fix" → "Fixed", "Won't fix" → "Accepted risk" (the latter now requires named approver, rationale, AND a re-evaluation date — the additional SOC2 hygiene #762 introduced). - "Initial Assessment: within 5 business days" prose dropped — the new SLA table covers triage timing more rigorously. Reporting email stays `security@rocketride.ai` (mailbox now exists, per the SOC2 follow-up). Refs #760
anandray
force-pushed
the
develop-security-soc2-05052026
branch
from
7893224 to
781f196
Compare
asclearuc
approved these changes
May 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds explicit triage/remediation SLA (critical 7d, high 30d, medium 90d), documents the current scanning toolchain (CodeQL, Scorecard, Trivy, Dependabot, secret scanning), branch protection on develop, and quarterly access reviews. Updates the reporting address from a non-routable security@ alias to anand.ray@rocketride.ai pending shared-mailbox creation.
Refs #760
Type
Testing
./builder testpassesChecklist
Linked Issue
Fixes #763
Summary by CodeRabbit