Add SECURITY.md (draft from 2026-10-04) #57

Activity

1. amar-python

   added

   securitySecuritySecurity

   backlog-10-04Carried over from the 2026-10-04 review sessionCarried over from the 2026-10-04 review session

   on Oct 25, 2026
2. amar-python commented on Oct 25, 2026

   

   amar-python

   on Oct 25, 2026 – with Claude

   OwnerAuthor

   More actions

   Automated verification: FAIL (verify_issues.py, 2026-10-25)

   SECURITY.md is not on main.

   ---

   Generated by Claude Code
3. amar-python

   added this to the Docs, claims and reporting milestone on Oct 25, 2026
4. amar-python

   added 2 commits that reference this issue on Nov 3, 2026

   docs(security): add placeholder reporting address (part of #57)

   ...

   74d1408

   Merge pull request #79 from amar-python/docs/security-md

   ...

   c7bebd1
5. amar-python

   closed this as completedin #79on Nov 3, 2026
6. amar-python commented on Nov 3, 2026

   

   amar-python

   on Nov 3, 2026

   OwnerAuthor

   More actions

   Reopening 3 Nov 2026

   PR #79 merged with singhofoz@gmail.com as a placeholder address — a Gmail that works as a working inbox so SECURITY.md can land on main. The HTML TODO comment in the file itself notes it's a placeholder:

   <!-- TODO 2026-11-03: this is a Gmail placeholder; replace with security@<org> once the dedicated address exists. Tracked in #57. -->

   GitHub auto-closed this issue from PR #79's body keyword. Reopening because the issue's actual completion criterion — a dedicated organisation security-reporting address exists and is reflected in SECURITY.md — is not yet met.

   Still needed

   • Set up security@<org> once your org domain supports it
   • Replace singhofoz@gmail.com and the TODO comment in SECURITY.md with the new address, as a small follow-up PR
   • Configure auto-forward to inbox + security-keyword filter (the 4 Oct mitigation noted in PR docs: add SECURITY.md (#57) — draft until the reporting address exists #79)

   Done when

   • SECURITY.md on main shows the dedicated org security@ address (no HTML TODO comment, no personal Gmail)
   • Reports to the dedicated address land in your inbox with the security-keyword filter applied

   No action needed on this issue until the dedicated domain is set up on your side.
7. amar-python

   reopened this on Nov 3, 2026
8. amar-python commented on Nov 3, 2026

   

   amar-python

   on Nov 3, 2026

   OwnerAuthor

   More actions

   Reopening 3 Nov 2026

   PR #79 merged with singhofoz@gmail.com as a placeholder address — a Gmail that works as a working inbox so SECURITY.md can land on main. The HTML TODO comment in the file itself notes it's a placeholder:

   <!-- TODO 2026-11-03: this is a Gmail placeholder; replace with security@<org> once the dedicated address exists. Tracked in #57. -->

   GitHub auto-closed this issue from PR #79's body keyword. Reopening because the issue's actual completion criterion — a dedicated organisation security-reporting address exists and is reflected in SECURITY.md — is not yet met.

   Still needed

   • Set up security@<org> once your org domain supports it
   • Replace singhofoz@gmail.com and the TODO comment in SECURITY.md with the new address, as a small follow-up PR
   • Configure auto-forward to inbox + security-keyword filter (the 4 Oct mitigation noted in PR docs: add SECURITY.md (#57) — draft until the reporting address exists #79)

   Done when

   • SECURITY.md on main shows the dedicated org security@ address (no HTML TODO comment, no personal Gmail)
   • Reports to the dedicated address land in your inbox with the security-keyword filter applied

   No action needed on this issue until the dedicated domain is set up on your side.