SECURITY.md and CODE_OF_CONDUCT.md exist in this repo and nowhere else. On stacktale-intellij and stacktale-vscode, GitHub's Security tab reads "no security policy" and the community-standards checklist is short two items.
That's the wrong outcome for a security policy in particular. The two extension repos are where a researcher lands after seeing the plugin in a marketplace listing, and they're the ones with no stated way to report anything privately.
Copying both files into each repo would work and then rot — three copies, and the next edit updates one of them.
What to do
GitHub reads community-health files from an org-level repository named .github, and applies them to every repo in the org that doesn't define its own. The org already has that repo — stacktale/.github — but it currently contains only profile/README.md.
- Move
SECURITY.md and CODE_OF_CONDUCT.md to the root of stacktale/.github. Not under profile/ — that directory is only for the org landing page. The health files go at the repository root, or in a .github/ subdirectory inside it.
- Delete them from this repo after confirming the defaults resolve, not before. A repo's own file always wins over the org default, so while both exist nothing changes; that's what makes the order safe.
CONTRIBUTING.md deliberately stays per-repo: building a Maven library, a Gradle IntelliJ plugin, and a TypeScript extension are three different sets of instructions, and a shared one would have to be vague enough to be useless.
While the file is being moved, SECURITY.md needs one edit: it names the supported version of the library, which says nothing about the two extensions. It should either state the policy in terms that hold for all three, or list them.
Verify
On stacktale-intellij, open Insights → Community Standards. "Code of conduct" and "Security policy" should both show as satisfied, with the source shown as inherited from the org. Then confirm the same on stacktale-vscode, and that this repo still resolves after its local copies are removed.
SECURITY.mdandCODE_OF_CONDUCT.mdexist in this repo and nowhere else. Onstacktale-intellijandstacktale-vscode, GitHub's Security tab reads "no security policy" and the community-standards checklist is short two items.That's the wrong outcome for a security policy in particular. The two extension repos are where a researcher lands after seeing the plugin in a marketplace listing, and they're the ones with no stated way to report anything privately.
Copying both files into each repo would work and then rot — three copies, and the next edit updates one of them.
What to do
GitHub reads community-health files from an org-level repository named
.github, and applies them to every repo in the org that doesn't define its own. The org already has that repo —stacktale/.github— but it currently contains onlyprofile/README.md.SECURITY.mdandCODE_OF_CONDUCT.mdto the root ofstacktale/.github. Not underprofile/— that directory is only for the org landing page. The health files go at the repository root, or in a.github/subdirectory inside it.CONTRIBUTING.mddeliberately stays per-repo: building a Maven library, a Gradle IntelliJ plugin, and a TypeScript extension are three different sets of instructions, and a shared one would have to be vague enough to be useless.While the file is being moved,
SECURITY.mdneeds one edit: it names the supported version of the library, which says nothing about the two extensions. It should either state the policy in terms that hold for all three, or list them.Verify
On
stacktale-intellij, open Insights → Community Standards. "Code of conduct" and "Security policy" should both show as satisfied, with the source shown as inherited from the org. Then confirm the same onstacktale-vscode, and that this repo still resolves after its local copies are removed.