From 0f5fede0b2d16f8b55abbf08a1c7bad091d6b6e7 Mon Sep 17 00:00:00 2001 From: Valentino Saputra Date: Sun, 2 Aug 2026 17:06:21 +0700 Subject: [PATCH] docs: establish security reporting and review policy --- CONTRIBUTING.md | 12 ++++++++++++ SECURITY.md | 20 ++++++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..9154bc3 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,12 @@ +# Contributing + +Contributions are welcome when they are focused, testable, and safe to review. + +1. Create a branch from the current default branch. +2. Make one coherent change and add regression coverage where applicable. +3. Run the repository's documented tests and static checks. +4. Open a pull request in English that explains the impact and validation. + +Do not include secrets, credentials, private infrastructure details, or customer +data. Security-sensitive changes require independent review before merge. Report +suspected vulnerabilities privately according to `SECURITY.md`. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..af8bbf6 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,20 @@ +# Security Policy + +## Supported versions + +Security fixes target the latest release on the default branch. Upgrade to the +newest version before reporting a problem. + +## Private reporting + +Do not open a public issue for an undisclosed vulnerability. Use GitHub private +vulnerability reporting: + + + +Include the affected version or commit, reproduction steps, expected and actual +behavior, and potential impact. Remove credentials, private keys, IP addresses, +hostnames, and customer data. + +Maintainers will acknowledge the report, validate the finding, and coordinate a +fix and disclosure timeline with the reporter.