Skip to content

docs(security): route reports through private advisories - #6728

Merged
jmecom merged 1 commit into
mainfrom
jm/private-vulnerability-reporting
Aug 24, 2026
Merged

docs(security): route reports through private advisories#6728
jmecom merged 1 commit into
mainfrom
jm/private-vulnerability-reporting

Conversation

@jmecom

@jmecom jmecom commented Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Routes security researchers to GitHub's private vulnerability reporting workflow instead of a public issue or email-first disclosure.

  • Makes the private advisory form the primary path in SECURITY.md, with email retained as a fallback.
  • Adds private-reporting links to the contributor guide, issue chooser, and bug template.

Checked with git diff --check, Ruby YAML parsing, and confirmation that private vulnerability reporting is enabled for block/buzz.

@jmecom
docs(security): route reports through private advisories
45720c5 
Signed-off-by: Jordan Mecom <jm@squareup.com>
@jmecom
jmecom marked this pull request as ready for review August 24, 2026 21:36
@jmecom
jmecom requested a review from a team as a code owner August 24, 2026 21:36
wesbillman
wesbillman reviewed Aug 24, 2026
View reviewed changes

@wesbillman wesbillman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Carl, an automated reviewer, commenting via Wes’s GitHub account.

PASS (comment-only; no approval requested). Reviewed exact head 45720c5b9c97f9d2309ececca17608b906344ba5 against base/current main@f6e6617a9dcc2308d5039f8afaab974b49fb9577.

The four entry points consistently steer researchers away from public disclosure and into GitHub's private advisory workflow, while preserving buzz@block.xyz as a fallback. I verified through GitHub's API that private vulnerability reporting is enabled for block/buzz, parsed .github/ISSUE_TEMPLATE/config.yml successfully with Ruby YAML, and found no contradictory reporting path in the changed surfaces. The advisory URL and relative SECURITY.md link are correctly formed.

No actionable findings. The remaining in-progress CI jobs are merge gating, not review findings.

@jmecom
jmecom merged commit 02dc49f into main Aug 24, 2026
24 checks passed
@jmecom
jmecom deleted the jm/private-vulnerability-reporting branch August 24, 2026 22:07
morgmart pushed a commit that referenced this pull request Aug 24, 2026
Rivet
Merge remote-tracking branch 'origin/main' into morganm/deeplink-root…
bac1ca1 
…-timeline

* origin/main:
  fix(desktop): restore icon-only remote marker (#6491)
  fix(ci): prevent poisoned Rust caches (#6618)
  docs(security): route reports through private advisories (#6728)
  fix(composer): wrap Buzz chip labels without orphaning icons (#6581)

Signed-off-by: Rivet <a08d9a8418c7ff03afe19964724c8fd87bf1776ab9e9b9cafb8cc920edd02a6e@buzz.block.builderlab.xyz>

# Conflicts:
#	desktop/tests/e2e/navigation.spec.ts
baxen pushed a commit that referenced this pull request Aug 25, 2026
ss-dev-00
Merge remote-tracking branch 'origin/main' into ss-dev-00/agent-activ…
105a365 
…ity-cover

* origin/main:
  feat(desktop): simplify the message action rail (#6529)
  fix(desktop): restore icon-only remote marker (#6491)
  fix(ci): prevent poisoned Rust caches (#6618)
  docs(security): route reports through private advisories (#6728)
  fix(composer): wrap Buzz chip labels without orphaning icons (#6581)

Signed-off-by: ss-dev-00 <a02c4e0850e5e612b4ddf95dbe2f5c56467cf27c6552203bc833ff438fb31971@buzz.block.builderlab.xyz>
michaelneale added a commit that referenced this pull request Aug 25, 2026
@michaelneale
Merge remote-tracking branch 'origin/main' into micspiral/mesh-0.76.0…
8cffb88 
…-rc3

* origin/main: (86 commits)
  Centralize replaceable event persistence (#6660)
  feat(workflows): discover trigger filter values (#6712)
  feat(desktop): simplify the message action rail (#6529)
  fix(desktop): restore icon-only remote marker (#6491)
  fix(ci): prevent poisoned Rust caches (#6618)
  docs(security): route reports through private advisories (#6728)
  fix(composer): wrap Buzz chip labels without orphaning icons (#6581)
  fix(desktop): bound thread /query and surface load errors, not false-empty (#6447)
  fix(messages): route edits to the owning composer (#6575)
  fix(mobile): join starter channels after accepting invite (#5915)
  Add mobile profile editing (#6583)
  fix(desktop): align jump-to-latest pill with composer height (#6606)
  fix(desktop): emit singular `mention` feed category so alerts route correctly (#6665)
  fix(mobile): recover stale and shuffled messages (#6691)
  feat(mobile): browse and join open channels (#6243)
  show mention counts in channel notifications (#6696)
  fix(desktop): hide selection formatting tray on composer right-click (#6683)
  fix(desktop): stabilize members dialog scrolling (#6670)
  fix(desktop): keep member runtime status off the UI thread (#6445)
  perf(desktop): persist channel heads, collapse thread reads and reply sends (#6572)
  ...
brow added a commit that referenced this pull request Aug 25, 2026
@brow
Merge remote-tracking branch 'origin/main' into codex/mobile-push-not…
63e22be 
…ifications-pr

* origin/main:
  Centralize replaceable event persistence (#6660)
  feat(workflows): discover trigger filter values (#6712)
  feat(desktop): simplify the message action rail (#6529)
  fix(desktop): restore icon-only remote marker (#6491)
  fix(ci): prevent poisoned Rust caches (#6618)
  docs(security): route reports through private advisories (#6728)
  fix(composer): wrap Buzz chip labels without orphaning icons (#6581)
  fix(desktop): bound thread /query and surface load errors, not false-empty (#6447)

Signed-off-by: Tom Brow <tomb@block.xyz>
@adrienlacombe adrienlacombe mentioned this pull request Aug 25, 2026
Open
wpfleger96 pushed a commit that referenced this pull request Aug 25, 2026
Duncan
Merge remote-tracking branch 'origin/main' into wpfleger/deterministi…
adae0af 
…c-agent-commit-identity

* origin/main: (54 commits)
  Extract community persistence (#6668)
  Fix mobile Huddle agent voice turn states (#6611)
  Add inline profile camera capture (#6680)
  Hide Huddles in mobile agent DMs (#6676)
  fix(desktop): polish inline chip states (#6718)
  Centralize replaceable event persistence (#6660)
  feat(workflows): discover trigger filter values (#6712)
  feat(desktop): simplify the message action rail (#6529)
  fix(desktop): restore icon-only remote marker (#6491)
  fix(ci): prevent poisoned Rust caches (#6618)
  docs(security): route reports through private advisories (#6728)
  fix(composer): wrap Buzz chip labels without orphaning icons (#6581)
  fix(desktop): bound thread /query and surface load errors, not false-empty (#6447)
  fix(messages): route edits to the owning composer (#6575)
  fix(mobile): join starter channels after accepting invite (#5915)
  Add mobile profile editing (#6583)
  fix(desktop): align jump-to-latest pill with composer height (#6606)
  fix(desktop): emit singular `mention` feed category so alerts route correctly (#6665)
  fix(mobile): recover stale and shuffled messages (#6691)
  feat(mobile): browse and join open channels (#6243)
  ...

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wesbillman wesbillman wesbillman left review comments
@wpfleger96 wpfleger96 wpfleger96 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jmecom @wesbillman @wpfleger96