docs: modernize security policy and vulnerability reporting #3660
+50
−32
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
MoralCode
requested changes
Feb 9, 2026
Comment on lines
+34
to
+40
| ### Responsible Disclosure Guidelines | ||
|
|
||
| We follow responsible disclosure practices: | ||
|
|
||
| - **Embargo Period**: We ask that you allow maintainers a reasonable amount of time to investigate and release a fix before public disclosure. | ||
| - **Credit**: We will acknowledge your discovery in security release notes (unless you prefer anonymity) | ||
| - **Coordination**: We will work with you to coordinate the disclosure and release timeline | ||
| - **No Public Issues**: Please do not create public GitHub issues or pull requests for security vulnerabilities | ||
| - **Confidentiality**: We treat all vulnerability reports with strict confidentiality | ||
|
|
||
| ### Security Release Process | ||
|
|
||
| When a security vulnerability is confirmed: | ||
|
|
||
| 1. A fix is developed and tested | ||
| 2. A security release is prepared | ||
| 3. Users are notified via security advisories | ||
| 4. The vulnerability is publicly disclosed only after the patch is released and available | ||
|
|
||
| Thank you for helping keep Augur secure! |
Contributor
There was a problem hiding this comment.
This process will need confirmation from the maintainers since a lot of this language commits us to doing things
Siddhazntx
force-pushed
the
update-security-policy
branch
2 times, most recently
from
9f2da60 to
af891ce
Compare
Signed-off-by: itz-sidd <siddhantofficial002@gmail.com>
Siddhazntx
force-pushed
the
update-security-policy
branch
2 times, most recently
from
e6c1651 to
ca1bfa8
Compare
MoralCode
reviewed
Feb 9, 2026
Siddhazntx
force-pushed
the
update-security-policy
branch
from
ca1bfa8 to
154c3a5
Compare
MoralCode
requested changes
Feb 10, 2026
SECURITY.md
Outdated
Comment on lines
14
to
16
| ### Private Disclosure Process | ||
|
|
||
| If you discover a security vulnerability in Augur, please report it privately: | ||
| ### Private Disclosure Process |
Contributor
There was a problem hiding this comment.
this change will make this heading be duplicated
Author
There was a problem hiding this comment.
Thanks for pointing that out. I've cleaned up the duplicate heading in SECURITY.md and ensured the text flows properly. I also updated the template with the guidance and AI disclosure we discussed earlier. Is the draft good now !
MoralCode
added
the
discussion
Signed-off-by: itz-sidd <siddhantofficial002@gmail.com>
Siddhazntx
force-pushed
the
update-security-policy
branch
from
154c3a5 to
57c70e8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This draft PR proposes an update to SECURITY.md to:
Since security policy involves maintainer-level decisions, this PR is opened as a draft to facilitate discussion and refinement before finalizing implementation.
Open Questions for Maintainers
2.Is there a preferred dedicated security contact email address?
This PR fixes #3655
Notes for Reviewers
Signed commits