security: a disclosure policy, and Dependabot for the four dependency surfaces - #44
Open
distronode-com wants to merge 1 commit into
Open
security: a disclosure policy, and Dependabot for the four dependency surfaces#44distronode-com wants to merge 1 commit into
distronode-com wants to merge 1 commit into
Conversation
… surfaces There was no SECURITY.md, so someone who found a vulnerability had nowhere obvious to send it and no idea what would happen to it. The one added here points at GitHub's private vulnerability reporting rather than an email address - it is already available on this repository, it does not need a mailbox anyone has to remember to watch, and it gives the reporter a private thread instead of an issue that discloses the bug the moment it is filed. It also says what a report should contain, what response to expect and by roughly when, and that credit is offered if the reporter wants it. Supported versions are stated as what is actually true pre-1.0: fixes land on the latest release line and are not backported. The Dependabot config covers the four places this repository takes a dependency, each on a weekly schedule: Go modules at the root, the SvelteKit admin app under /frontend (pnpm is handled by the npm ecosystem), the actions pinned in .github/workflows, and the base images in the root Dockerfile. No groups and no ignores - the point is to see the updates rather than to shape them, and a config with rules in it that nobody revisits is how a surface quietly stops being watched. The commit before this one closed fourteen advisories by hand; this is the part that means the next fourteen do not have to be found by hand. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes in this run: the full PR (2 files, disclosure policy + Dependabot).
SECURITY.md— Private disclosure via GitHub vulnerability reporting, report contents, response expectations, and a supported-versions table limited to the latest0.xline (0.9.x, matching currentCHANGELOG)..github/dependabot.yml— Weekly updates for the four in-tree surfaces:gomodat/,npmat/frontend(pnpm),github-actionsat/, anddockerat/.
All four Dependabot ecosystems match files that exist on the tree (go.mod/go.sum, frontend/package.json + pnpm-lock.yaml, .github/workflows/*, root Dockerfile). No application behavior changes.
ℹ️ Enable private vulnerability reporting after merge
SECURITY.md sends reporters only to the Security tab’s Report a vulnerability button and forbids public issues/PRs. That button appears only when the repo setting Private vulnerability reporting is on. If it is still off, the policy has no working intake path.
Technical details
# Enable PVR so SECURITY.md intake works
## Affected sites
- Repo Settings → Code security and analysis → Private vulnerability reporting (not in this PR)
- SECURITY.md “Reporting a vulnerability” section assumes the button exists
## Required outcome
- After merge, PVR is enabled on Calnode/calnode so external reporters can open a private thread as documented
- Optional: confirm the Security tab shows both the policy and the report button
## Open questions for the human
- None if PVR is already on; this is a one-time settings checkGrok ｜ 𝕏
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two files Scorecard looks for and the repository does not have.
SECURITY.mdpoints reporters at GitHub's private vulnerability reporting (the Security tab's "Report a vulnerability" button) rather than an email address, says what to include, and says what to expect: an acknowledgement within a few days, then a fix or a written reason, a public advisory with the release, and credit if wanted. It states the support policy as it is today for a pre-1.0 project: fixes land on the latest0.xline only. If you would rather name an address or a different support window, that is a two-line edit..github/dependabot.ymlcovers the four dependency surfaces the tree actually has, all weekly:gomodat the root,npminfrontend/(pnpm is handled by the npm ecosystem),github-actions, anddockerfor the rootDockerfile. No groups, no ignores; it can be tuned once the first batch of PRs shows what the noise level is.🤖 Generated with Claude Code