Repository navigation
Provide a private vulnerability-reporting route across public repositories #208
Description
Problem
The organization now publishes its security-maintainer responsibilities, but the GitHub reporting setting is disabled on every one of its 11 public repositories. The default security policy also lacks a private reporting route.
Acceptance
- Enable GitHub private vulnerability reporting on the existing public repositories.
- Verify each setting and the public reporting entry point.
- Document the Security → Advisories → Report a vulnerability route in the default security policy while preserving the maintainer statement verbatim.
Use GitHub's existing reporting feature. No new paid service, reporting address, response-time promise or publication of report details is needed. Reference: GitHub's private reporting documentation.
Activity
rmcdaniel commentedon Oct 19, 2026
Private vulnerability reporting is now enabled on all 11 public repositories:
.github,workflow,server,waterline,sdk-php,sdk-python,sdk-rust,cli,ai,sample-appanddurable-workflow.github.io.Each enablement has an independent API readback (
enabled: true). Anonymous HTTP reads of all 11 Advisories pages show Report a vulnerability. No test report or security advisory was created, no report details were made public and no paid feature was enabled.The policy directions are in #209; its normal checks are pending. The supplied security-maintainer statement remains unchanged.
rmcdaniel commentedon Oct 19, 2026
Private vulnerability reporting is enabled on all 11 public repositories, with independent settings and anonymous public-button verification. The default policy directions are merged in #209 at
7b3eb7f00e8779fcf3802d7e3a14321020f554ff, wholeb95aa7ea6a652f1c8efdc76becbf66d29c222991, identical to the reviewed/tested candidate.Live HTTP readback confirms the reporting directions on every repository's inherited Security policy page. The supplied security-maintainer statement is unchanged, and the completed remote branch is deleted. All three candidate and three independent main checks PASS (repository39277229309, SonarQube39277229313 and the app check). No test report was submitted, so this verifies configuration and public discoverability rather than a completed vulnerability-triage exercise.