Skip to content

docs: add SECURITY.md (#57) — draft until the reporting address exists - #79

Draft
amar-python wants to merge 1 commit into
mainfrom
docs/security-md
Draft

amar-python wants to merge 1 commit into
mainfrom
docs/security-md

Conversation

@amar-python

Copy link
Copy Markdown
Owner

Closes #57 once the address is in.

This adds SECURITY.md using the draft approved on 2026-10-04 (see DECISIONS/2026-10-04-security-md.md). Decisions it follows:

  • Narrow scope, email-only reporting channel.
  • Standard SLA, phrased as best-effort.
  • PGP, Safe Harbour, Hall of Thanks and Scope sections kept.
  • "Last audited" field added.

Draft: do not merge yet. The reporting address is REPLACE_ME because the dedicated address hasn't been created. When it exists:

  1. Replace REPLACE_ME with the address.
  2. Set the address to auto-forward to your inbox, with a filter flagging security keywords (the 4 Oct mitigation).
  3. Mark this PR ready and merge.

Two small changes from the 4 Oct draft:

  • The scope line names api/requirements.txt, the actual path.
  • The dates read 2026-10-26.

The DB-free pytest run gave 118 passed.


Generated by Claude Code

Draft as approved on 2026-10-04 with the 'last audited' field added.
The reporting address is a REPLACE_ME placeholder until the dedicated
address exists; do not merge before it is filled in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YPoXzBSj89ZHgw7nfTmbB
@amar-python amar-python added this to the Docs, claims and reporting milestone Oct 25, 2026 — with Claude
@amar-python amar-python added the security Security label Oct 25, 2026 — with Claude
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security Security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add SECURITY.md (draft from 2026-10-04)

2 participants