Add an org-wide SECURITY.md#4
Conversation
Signed-off-by: averevki <sandyverevkin@gmail.com>
📝 WalkthroughWalkthroughA new ChangesSecurity Policy
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
SECURITY.md (2)
15-16: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAdd fallback contact method for when Private Vulnerability Reporting is unavailable.
If Private Vulnerability Reporting is not enabled on a specific repository, or if a reporter cannot access GitHub, there is no alternative reporting channel. Consider adding a security email address or alternative contact method for such cases.
2. Click **"Report a vulnerability"** under **Advisories**. + + If Private Vulnerability Reporting is not available, please email us at + security@kuadrant.io (or the appropriate security contact).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` around lines 15 - 16, The Security.md guidance only describes GitHub Private Vulnerability Reporting, so add a fallback contact path for cases where it is unavailable or GitHub access is blocked. Update the security reporting instructions in SECURITY.md to include an alternative channel such as a security email address or other contact method, and keep it alongside the existing report-a-vulnerability steps so readers can find it easily.
36-40: 🔒 Security & Privacy | 🔵 TrivialResponse timelines are reasonable but verify organizational capacity.
The committed response timelines (5 business days for acknowledgement, 10 for severity determination) are good practices. Ensure the security team has sufficient coverage to meet these commitments consistently.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` around lines 36 - 40, The response timeline section in SECURITY.md commits to fixed acknowledgement and severity-determination windows, so update the wording around the bullets to make clear these are targets or commitments only if the security team has sufficient coverage. Keep the same timeline values in the SECURITY.md section, but add a brief qualifier that operational capacity and staffing are in place to consistently meet them.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@SECURITY.md`:
- Around line 15-16: The Security.md guidance only describes GitHub Private
Vulnerability Reporting, so add a fallback contact path for cases where it is
unavailable or GitHub access is blocked. Update the security reporting
instructions in SECURITY.md to include an alternative channel such as a security
email address or other contact method, and keep it alongside the existing
report-a-vulnerability steps so readers can find it easily.
- Around line 36-40: The response timeline section in SECURITY.md commits to
fixed acknowledgement and severity-determination windows, so update the wording
around the bullets to make clear these are targets or commitments only if the
security team has sufficient coverage. Keep the same timeline values in the
SECURITY.md section, but add a brief qualifier that operational capacity and
staffing are in place to consistently meet them.
1 participant
Summary
SECURITY.mdto the org-level.githubrepo, automatically inherited by all Kuadrant repositoriesThis PR addresses Kuadrant/kuadrant-operator#2039
Summary by CodeRabbit