docs: add SECURITY.md - #274
Conversation
Points at security@pgedge.com as the single reporting route and at the pgEdge Vulnerability Disclosure Statement for scope, safe harbour and CVE handling. Identical across every pgEdge product repository. Do not merge before pgEdge/pgedge-docs#138 publishes docs.pgedge.com/security; until it does, the only link in this file 404s.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. WalkthroughAdded ChangesSecurity Policy
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This PR adds a repository security policy without introducing a concrete correctness, security, or availability issue. No actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
The statement URL and the reporting address were bare text. Dave asked for the URL to be a real link on pgedge-safesession#73: GitHub autolinks it, but nothing guarantees another viewer will, and the two actionable things in a security policy should not depend on a renderer. The published statement at docs.pgedge.com/security already writes the address as an explicit mailto link, so this keeps the two documents consistent. Identical across every repo carrying this file.
2 participants
Adds
SECURITY.mdto the repository root. It names security@pgedge.com asthe single reporting route and points at the pgEdge Vulnerability Disclosure
Statement for scope, safe harbour and CVE handling.
The file is identical in every pgEdge product repository — nothing in it is
repo-specific.
Why an in-repo copy when there is an org default
pgEdge/.githubcarries the same file as an organisation default, which coversevery repository that has none of its own. Defaults do not appear in a
repository's file tree, git history, clones or release archives — only in the
Security tab. A product a customer clones or vendors should carry its own
policy, and OpenSSF Scorecard's security-policy check only looks in the
repository itself.
Draft on purpose — merge order matters
The only link in this file is
https://docs.pgedge.com/security, and that URLreturns 404 today. Merging before the statement is live publishes a
security policy whose one actionable link is dead.
Merge order:
docs.pgedge.com/security. Out ofdraft and awaiting review.
No action needed from you until #138 merges. Reviews welcome now.
Summary by CodeRabbit