Enhance SECURITY.md with detailed security guidelines - #17
Conversation
Expanded the security policy to include supported versions, reporting vulnerabilities, response timelines, and security best practices for contributors.
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR enhances the SECURITY.md file with comprehensive security guidelines. The document is well-structured and covers essential topics including vulnerability reporting, response timelines, and security best practices.
Critical Issue Found:
- Line 23 references emailing the maintainer directly but provides no contact information, blocking the fallback reporting mechanism
Once the contact information is added, this security policy will provide clear guidance for responsible vulnerability disclosure.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| Fill in the advisory form with as much detail as possible | ||
|
|
||
| Option 2 — Direct Contact | ||
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. |
There was a problem hiding this comment.
🛑 Security Risk: Missing contact information for direct vulnerability reporting. Line 23 instructs users to "email the maintainer directly" but provides no email address or contact method. This blocks the security reporting process when GitHub's advisory system is unavailable, potentially leaving critical vulnerabilities unreported.
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. | |
| If GitHub's advisory system is unavailable, email security@example.com with [SECURITY] post-quantum-studio in the subject line. |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new SECURITY.md file outlining the project's security policy, reporting guidelines, and response timeline. The review feedback suggests several formatting and content improvements: adding standard Markdown headers for proper document hierarchy, converting text-based lists into standard Markdown tables for the 'Supported Versions' and 'Response Timeline' sections, and providing a contact email address for direct vulnerability reporting.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| Security Policy | ||
| Supported Versions |
There was a problem hiding this comment.
The document lacks Markdown headers (e.g., #, ##). Without them, the document will render as plain text without visual hierarchy, and it will be difficult for screen readers to navigate. Please use standard Markdown header syntax for sections and subsections.
| Security Policy | |
| Supported Versions | |
| # Security Policy | |
| ## Supported Versions |
| Version Supported | ||
| main ✅ Active support | ||
| Older branches ❌ Not supported |
There was a problem hiding this comment.
The supported versions list is formatted with tabs/spaces instead of a standard Markdown table. This will not render correctly as a table in most Markdown parsers. Please use standard Markdown table syntax.
| Version Supported | |
| main ✅ Active support | |
| Older branches ❌ Not supported | |
| | Version | Supported | | |
| | --- | --- | | |
| | main | ✅ Active support | | |
| | Older branches | ❌ Not supported | |
| Fill in the advisory form with as much detail as possible | ||
|
|
||
| Option 2 — Direct Contact | ||
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. |
There was a problem hiding this comment.
The policy mentions emailing the maintainer directly but does not provide an email address or a link/reference to where it can be found. Please provide a contact email address (or a placeholder like security@example.com) so security researchers know where to send reports if the GitHub Private Security Advisory system is unavailable.
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. | |
| If GitHub's advisory system is unavailable, email the maintainer directly at [security@example.com]. Include [SECURITY] post-quantum-studio in the subject line. |
| Stage Target Timeframe | ||
| Initial acknowledgment Within 48 hours | ||
| Severity assessment Within 5 business days | ||
| Patch / mitigation Within 14–30 days (severity-dependent) | ||
| Public disclosure After patch is released and verified |
There was a problem hiding this comment.
The response timeline list is formatted with tabs/spaces instead of a standard Markdown table. This will not render correctly as a table in most Markdown parsers. Please use standard Markdown table syntax.
| Stage Target Timeframe | |
| Initial acknowledgment Within 48 hours | |
| Severity assessment Within 5 business days | |
| Patch / mitigation Within 14–30 days (severity-dependent) | |
| Public disclosure After patch is released and verified | |
| | Stage | Target Timeframe | | |
| | --- | --- | | |
| | Initial acknowledgment | Within 48 hours | | |
| | Severity assessment | Within 5 business days | | |
| | Patch / mitigation | Within 14–30 days (severity-dependent) | | |
| | Public disclosure | After patch is released and verified | |
There was a problem hiding this comment.
Pull request overview
This PR adds a new SECURITY.md to document the repository’s security policy, including supported versions, vulnerability reporting guidance, response timelines, and contributor security best practices.
Changes:
- Introduces a security policy document covering reporting channels and expected response SLAs.
- Adds contributor-focused security guidance and a dependency-scanning section.
- Includes a references section for further security/standards documentation.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Security Policy | ||
| Supported Versions | ||
| The following versions of post-quantum-studio are currently receiving security updates: | ||
|
|
| Version Supported | ||
| main ✅ Active support | ||
| Older branches ❌ Not supported |
| Reporting a Vulnerability | ||
| ⚠️ Do NOT open a public GitHub issue for security vulnerabilities. | ||
|
|
| Response Timeline | ||
| Stage Target Timeframe | ||
| Initial acknowledgment Within 48 hours | ||
| Severity assessment Within 5 business days | ||
| Patch / mitigation Within 14–30 days (severity-dependent) | ||
| Public disclosure After patch is released and verified |
|
|
||
| Never commit secrets — API keys, private keys, or seed material must never be committed. Use .env files (gitignored) or secrets managers. | ||
|
|
||
| Pin dependencies — Use exact versions in package.json and review package-lock.json diffs carefully. |
| Dependency Scanning | ||
| This repository uses automated tooling to detect vulnerable dependencies: | ||
|
|
||
| Dependabot — Monitors npm dependencies for known CVEs | ||
|
|
||
| CodeQL — Static analysis for JavaScript/TypeScript security patterns | ||
|
|
||
| Trivy — Container and filesystem vulnerability scanning (if Docker is added) | ||
|
|
||
| If you identify a dependency issue not caught by these tools, please report it per the process above. |
| References | ||
| NIST Post-Quantum Cryptography Standardization | ||
|
|
||
| NIST FIPS 203 (ML-KEM) | ||
|
|
||
| NIST FIPS 204 (ML-DSA) | ||
|
|
||
| NIST FIPS 205 (SLH-DSA) | ||
|
|
||
| GitHub Private Security Advisories |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 231159bc1f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Fill in the advisory form with as much detail as possible | ||
|
|
||
| Option 2 — Direct Contact | ||
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. |
There was a problem hiding this comment.
If GitHub private advisories are unavailable or disabled for this repo, this fallback path still does not tell reporters what address to use. In that scenario a researcher cannot privately report the vulnerability without opening a public issue or searching elsewhere, so the security policy's reporting process is incomplete.
Useful? React with 👍 / 👎.
| Audit new crypto code — Any new cryptographic implementation should include a reference to the specification it implements. | ||
|
|
||
| Dependency Scanning | ||
| This repository uses automated tooling to detect vulnerable dependencies: |
There was a problem hiding this comment.
This says the repository uses automated dependency scanning, but I checked the tracked files and there is no .github/dependabot.yml, CodeQL workflow, Trivy workflow/config, or Dockerfile. In contexts where maintainers rely on this policy as the source of security controls, vulnerable dependencies can be assumed covered when no scan is actually running; either add the configs or describe these tools as planned/recommended.
Useful? React with 👍 / 👎.
|
Closing as superseded by #24, which bundles the CI workflow and SECURITY.md. Reopen if needed. |
Expanded the security policy to include supported versions, reporting vulnerabilities, response timelines, and security best practices for contributors.