From dfe88fd2d053651e0ddad963f425aa94c0274b5a Mon Sep 17 00:00:00 2001 From: Nicolas Joubert Date: Thu, 22 Oct 2026 17:22:19 +0200 Subject: [PATCH 1/2] #341 - Add a security policy (SECURITY.md, private vulnerability reporting), no GITHUB_TOKEN permission for the notifications workflow Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/notifications.yml | 3 +++ SECURITY.md | 20 ++++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 SECURITY.md diff --git a/.github/workflows/notifications.yml b/.github/workflows/notifications.yml index 30047958..ef3ed213 100644 --- a/.github/workflows/notifications.yml +++ b/.github/workflows/notifications.yml @@ -6,6 +6,9 @@ on: tags: - '*' +# The job only calls a webhook: no permission for the GITHUB_TOKEN +permissions: {} + jobs: notification: runs-on: ubuntu-latest diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..8b06b666 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,20 @@ +Security Policy +=============== + +Supported versions +------------------ + +Security fixes are released for the latest minor version of the current major version (5.x). + +Reporting a vulnerability +------------------------- + +**Do not report security vulnerabilities through public GitHub issues, discussions or pull requests.** + +Report them privately with the GitHub form: +[Report a vulnerability](https://github.com/cleverage/process-bundle/security/advisories/new) (Security tab of this +repository, "Report a vulnerability"). + +Please include the affected version, a description of the issue and of its impact, and the steps or the configuration to +reproduce it. You will receive an answer as soon as possible. Once the vulnerability is confirmed, a fix is prepared in a +private fork, released, and a security advisory is published, crediting you unless you prefer otherwise. From 1d161bd8fe5cd349aefb297f35319168b5274dce Mon Sep 17 00:00:00 2001 From: Nicolas Joubert Date: Fri, 23 Oct 2026 09:12:22 +0200 Subject: [PATCH 2/2] #341 - Keep SECURITY.md version-agnostic Co-Authored-By: Claude Opus 5.5 (1M context) --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 8b06b666..bb34eb3e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,7 @@ Security Policy Supported versions ------------------ -Security fixes are released for the latest minor version of the current major version (5.x). +Security fixes are released for the latest minor version of the current major version. Reporting a vulnerability -------------------------