Repository navigation
fix(security): point disclosure at the advisory form - #34
Merged
Merged
Conversation
SECURITY.md linked /issues/new and called it a private issue. That form creates a public issue, contradicting the instruction not to disclose publicly. Private vulnerability reporting is enabled on this repo, so link the security advisory form instead. Drop Supported Versions: its body was unedited GitHub boilerplate addressed to the repo owner, and a template repo has no versions to support.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SECURITY.mdlinked/issues/newand described it as a "private issue". That form creates a public issue, which contradicts the file's own closing instruction not to disclose publicly./security/advisories/new. Private vulnerability reporting is enabled on this repository, so the form resolves.Supported Versionssection: its body was unedited GitHub boilerplate addressed to the repo owner ("Use this section to tell people..."), and a template repository has no versions to support.This repository is named
.github, so its root community-health files act as defaults for repos in this account that do not ship their own. A wrong disclosure channel here propagates.Test plan
Greptile Summary
This change replaces the public issue link in the security policy with GitHub’s private vulnerability-reporting flow, preserves email as an alternative contact method, and removes the unused supported-versions placeholder.
The reported advisory-routing issue was not retained: a live request to the exact URL in
SECURITY.mdredirected toiap/twilight-darkness-9489/security/advisories/new. This exercised the reporting path and showed that the link opens the affected repository’s private advisory form rather than misrouting reports to the shared.githubrepository.Confidence Score: 5/5
Safe to merge based on the verified private-reporting destination.
The only reported failure mode was checked against GitHub using the exact policy URL, and the observed redirect contradicted the claimed misrouting.
Files Needing Attention: None.
What T-Rex did
Reviews (1): Last reviewed commit: "fix(security): point disclosure at the a..." | Re-trigger Greptile