Skip to content

#341 - Add a security policy and a private channel to report vulnerabilities - #342

Open
njoubert-cleverage wants to merge 1 commit into
mainfrom
341
Open

njoubert-cleverage wants to merge 1 commit into
mainfrom
341

Conversation

@njoubert-cleverage

Copy link
Copy Markdown
Member

Description

Fixes #341.

  • New SECURITY.md: supported versions (latest minor of 5.x), report through the GitHub private vulnerability reporting form, never in a public issue.
  • notifications.yml: permissions: {} (the job only calls a webhook).
  • Repository settings, applied outside this pull request: private vulnerability reporting, secret scanning with push protection, Dependabot security updates, read-only default permissions of the workflows.

Requirements

  • Documentation updates
    • Reference
    • Changelog
  • Unit tests

Breaking changes

None.

🤖 Generated with Claude Code

…rting), no GITHUB_TOKEN permission for the notifications workflow

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add a security policy and a private channel to report vulnerabilities

1 participant