Repository navigation
chore(security): remove local SECURITY.md to inherit org-wide policy (#533) - #534
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Remove security policy SECURITY.md |
Deletes the policy, including its supported-version declaration, reporting instructions, response timelines, and coordinated-disclosure terms. |
Priority:
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Other
Suggested reviewers: donpetry-bot
Merge Risk: 
483b0
-
Vulnerability reporters retain a private reporting route through the organization policy. No actionable merge risk is established.
Pre-merge checks: 
-
Check name Status Explanation Resolution Linked Issues check Issue #533is a direct link. Its requirement is to resolve the OpenSSF Scorecard Security-Policy finding (score 4/10, 'security policy file detected'). The PR deletes the only root-level SECURITY.md. …Confirm that combsmith/.github/SECURITY.md exists on its default branch and that Scorecard resolves it for github.com/combsmith/markets. A scorecard run result or the next org-scorecard.yml scan result showing the Security-Policy check pass… -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: removing the local SECURITY.md to inherit the organization-wide security policy. Out of Scope Changes check The whole-PR diff (merge base 2bc2bf1 to head 483b08a) deletes one file, SECURITY.md, and changes nothing else. That deletion is the remediation that the linked issue #533and the PR description name.…Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Full details: Out of Scope Changes check
-
Explanation
The whole-PR diff (merge base 2bc2bf1 to head 483b08a) deletes one file, SECURITY.md, and changes nothing else. That deletion is the remediation that the linked issue
#533and the PR description name. No unrelated changes are present. The deleted file's content (supported versions, private reporting path, 72-hour acknowledgment, 30-day fix target, and coordinated disclosure) is replaced for this repository by the org-wide policy the PR references. That replacement depends on the external file described in the linkedIssuesAssessment, but the deletion itself is in scope.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.
-
Full details: Linked Issues check
-
Explanation
Issue
#533is a direct link. Its requirement is to resolve the OpenSSF Scorecard Security-Policy finding (score 4/10, 'security policy file detected'). The PR deletes the only root-level SECURITY.md. The diff at head (483b08a) against merge base (2bc2bf1) shows only this deletion. Reads of .github/SECURITY.md and docs/SECURITY.md at head failed with 'path does not exist', so no local policy remains at the locations that Scorecard checks. The change matches the remediation the PR describes. The score outcome depends on combsmith/.github/SECURITY.md, which lies outside this repository and cannot be read with the available tools. The PR author reports a 10/10 result from a local scorecard run, but no scan output is included in this review. The requirement is therefore not fully established.Resolution
Confirm that combsmith/.github/SECURITY.md exists on its default branch and that Scorecard resolves it for github.com/combsmith/markets. A scorecard run result or the next org-scorecard.yml scan result showing the Security-Policy check passing would establish compliance.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
Closes #533
Summary
Removes the local
SECURITY.mdincombsmith/marketsso the repository inherits the canonical org-wide security policy incombsmith/.github/SECURITY.mddirectly (10/10on OpenSSF Scorecard).Problem
When a repository defines a local
SECURITY.md, both GitHub and OpenSSF Scorecard evaluate only that local file and ignorecombsmith/.github/SECURITY.md. Removing the local file allows both GitHub's Security tab andscorecard --repo="github.com/combsmith/markets"to resolvecombsmith/.github/SECURITY.mdautomatically (10/10).Risk
Low — documentation cleanup only; org-wide policy in
combsmith/.github/SECURITY.mdtakes effect immediately upon merge.Test plan
scorecard --reporesolvesgithub.com/combsmith/.github/SECURITY.md(10/10) when no localSECURITY.mdis present.Rollback
Revert this PR commit.
Monitoring
Verify
org-scorecard.ymlresolvesgithub.com/combsmith/.github/SECURITY.md(10/10) on the next scheduled scan.Summary by CodeRabbit