[tannevaled]

There is no SECURITY.md in this repository, and none in go-embedded-ruby/.github either (both verified, 404). So a researcher who finds something has nowhere to send it except the public issue tracker.

That mattered less yesterday. The audit in #768 has just filed nine findings in the open, which is a standing invitation for the next person to do the same with something worse.

⚠️ Do not merge this until one setting is turned on

The policy tells people to report through GitHub's private vulnerability reporting, which is currently disabled on this repository:

$ gh api repos/go-embedded-ruby/ruby/private-vulnerability-reporting --jq .enabled
false

It needs enabling at Settings → Code security → Private vulnerability reporting, or gh api -X PUT repos/go-embedded-ruby/ruby/private-vulnerability-reporting. Until then the policy names a channel that does not exist, which is worse than having no policy — so this is yours to flip, and I have deliberately not tried to do it for you.

I chose that channel over an email address because it does not publish anyone's personal address on a public repository. If you would rather use an address, or a different channel entirely, say so and I will rewrite the Reporting section instead.

While you are on that page, three other defensive settings are also off and are free: secret scanning, push protection, and Dependabot security updates. Each is reversible with one click and none of them creates an obligation the way an inbox does.

What the policy actually says

Two sections carry the content; the rest is short on purpose.

In scope is written from what this audit found, not from a template:

• the host process dying, or hanging without bound, because of Ruby input — because Run returns an error, and an embedder has no way to defend against a fatal error: that recover() cannot catch (No call-depth limit: runaway Ruby recursion kills the embedding host with a fatal Go stack overflow (no SystemStackError) #768) or a call that never returns (Net::HTTP to a server in the program's own Thread hangs forever (MRI: 81 ms); raw TCPSocket client works #771);
• failing to raise where MRI raises, when a program relies on the raise to stay safe — the fail-open class, which is the dangerous one precisely because it is invisible to the caller (YAML.safe_load instantiates arbitrary classes; permitted_classes: [] permits everything and Psych::DisallowedClass is never raised #775, Regexp.timeout= is stored but never applied, and a fired limit returns nil instead of raising Regexp::TimeoutError (fail-open for validators) #776);
• reaching past the documented capability set, including any path from Ruby to the embedding program's Go state, or writing outside the io.Writer the embedder passed;
• secrets in the repository, and anything in the CI or release path that would run someone else's code with this repository's permissions.

Not a vulnerability is the part that keeps the inbox usable:

Run is not a sandbox, and that is documented, not accidental. […] So a report that system("...") executes a command is working as intended. A report that a documented restriction does not hold is not.

And, by the same reasoning, faithfully reproducing something that is dangerous in MRI — Marshal.load on attacker-controlled bytes — is conformance here rather than a defect. The policy still invites a report if the documentation fails to warn about it, which is the honest line to draw for a conformance project.

It is also deliberately modest about response time. There is no security team, and a timeline nobody is on call for is worth less than saying so plainly. What it does promise is that a report gets read, gets a plain answer about scope, and gets credit.

Finally it lists the six already-filed classes, so a duplicate costs the reporter nothing to avoid.

Merge order

The link to Run is not a sandbox resolves once #770 merges — that PR adds the heading. Verified: the string is not on main today. So #770 first, then this.

🤖 Generated with Claude Code

[tannevaled]

The condition this was held on is now met

$ gh api repos/go-embedded-ruby/ruby/private-vulnerability-reporting --jq .enabled
true

Private vulnerability reporting is enabled, so the channel this policy names
now exists and a report sent through it reaches someone. That was the whole of
the hold, and it was written as a measurable condition precisely so it could be
re-checked rather than remembered.

Checks are 9/9 green and the branch is CLEAN MERGEABLE. Merging.

Measured alongside it, and not part of this PR — two of the sibling
repositories still have it off, and both were tagged today:

repository	private reporting	secret scanning	push protection
go-embedded-ruby/ruby	✅	✅	❌
go-ruby-parser/parser	✅	✅	❌
go-ruby-yaml/yaml	❌	❌	❌
go-fleettools/fleettools	❌	❌	❌

🤖 Generated with Claude Code