chore: add CLAUDE.md with Hacken bug bounty PR guidelines#404
Conversation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a CLAUDE.md file to establish guidelines for security-related pull requests, specifically regarding the handling of bug bounty reports. The review feedback suggests expanding these guidelines to include PR titles and all security vulnerabilities, as well as adding standard build and test commands to better support the Claude Code tool.
| # CLAUDE.md | ||
|
|
There was a problem hiding this comment.
CLAUDE.md is intended to provide context for the Claude Code tool, specifically build and test commands. Including these commands (as found in the README) will allow the tool to operate more effectively within this repository.
| # CLAUDE.md | |
| # CLAUDE.md | |
| ## Build and Test | |
| - Build: make build | |
| - Test: make test | |
| - Lint: make lint | |
| - Benchmarks: make bench | |
|
|
||
| ## Security PRs | ||
|
|
||
| - For PRs that resolve Hacken bug bounty reports, do not include details about the bug in the PR description. Instead, link to a Linear issue that contains more details on the bug and the link to the Hacken bug bounty report. |
There was a problem hiding this comment.
The guideline should also explicitly mention PR titles, as they are often public and can inadvertently disclose vulnerability details. Additionally, consider generalizing this rule to all security-related PRs, not just Hacken reports, to ensure a consistent security posture for all sensitive fixes.
| - For PRs that resolve Hacken bug bounty reports, do not include details about the bug in the PR description. Instead, link to a Linear issue that contains more details on the bug and the link to the Hacken bug bounty report. | |
| - For PRs that resolve security vulnerabilities (including Hacken bug bounty reports), do not include details about the bug in the PR title or description. Instead, link to a Linear issue that contains the vulnerability details and a link to the original report. | |
2 participants
Summary
CLAUDE.mdfile with a "Security PRs" sectionCloses https://linear.app/celestia/issue/PROTOCO-1445/update-claudemd
Test plan
CLAUDE.mdis present at the repo root with the "Security PRs" section🤖 Generated with Claude Code