Skip to content

Security policy: private reporting, response and fix times, advisories - #5

Merged
kalfasyan merged 2 commits into
mainfrom
claude/project-thread-9meexj
Nov 5, 2026
Merged

kalfasyan merged 2 commits into
mainfrom
claude/project-thread-9meexj

Conversation

@kalfasyan

Copy link
Copy Markdown
Contributor

Brings the org-wide policy in line with the new SECURITY.md in each app repository:

  • It adds GitHub's private "Report a vulnerability", which is now on in every repo, next to email.
  • It states the response and fix times: a reply within 7 days, critical fixes released within 7 days, others within 30.
  • It covers disclosure: a GitHub advisory after each fix, a CVE when warranted, and credit.
  • Supported versions now refer to the release lines (:1, :2) instead of main.
  • It adds Shoppa and Calio.

The profile's install line now points to the installer's release (releases/latest/download/install.sh). Merge after the first docs release exists; see selfhostit/docs#15.


Generated by Claude Code

@kalfasyan
kalfasyan merged commit f577aa2 into main Nov 5, 2026
@kalfasyan
kalfasyan deleted the claude/project-thread-9meexj branch November 5, 2026 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants