Repository navigation
Publish the versioning, support and security policy - #173
Merged
Merged
Conversation
SECURITY.md states the supported versions, the reporting channels (GitHub private vulnerability reporting, then security@ochodek.net), a 14-day acknowledgement, a 90-day fix target, and disclosure through a GitHub Security Advisory plus deprecation on nuget.org; SECURITY.pl.md covers how to report. The README gives the support rules, and RELEASE-PROCESS gets a security-fix checklist and the 6-month support line for the previous major version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #102
Implements D13:
SECURITY.md(the full policy): supported versions (the latest minor of the latest major; the previous major gets security fixes for 6 months; previews aren't supported), reporting through GitHub private vulnerability reporting first andsecurity@ochodek.netas the fallback, acknowledgement within 14 days, a fix aimed within 90 days of confirming, disclosure through a GitHub Security Advisory (NuGet ecosystem, version ranges, a CVE when warranted, credit to the reporter unless they decline) and deprecation of the affected versions on nuget.org. The note about the public strong-name key stays.SECURITY.pl.md: how to report only, with the same two channels and a link to the English policy (ADR-0009).SECURITY.md; the SemVer scope was already there.docs/RELEASE-PROCESS.md: a "Security fix" checklist (draft advisory, private preparation, hotfix release, publish the advisory, deprecate on nuget.org, tell the reporter) and "Support for the previous major version" (release/1.xfrom the lastv1.*tag, with its setup in Set up the release/1.x support branch before 2.0 #119). The hotfix intro now says "within one major version".security@ochodek.netwas created and tested by the maintainer (#101).Checks
dotnet build(0 warnings) anddotnet format --verify-no-changes; docs only, so no test run./stop-slopon the English text,/miodkujonSECURITY.pl.md.release/1.xsetup also needs CI triggers, ruleset protection and an ADR-0008 change).For #119: besides
publicReleaseRefSpec, the release workflow and the environment rule, setting uprelease/1.xneeds CI triggers and ruleset protection for PRs into it, and an ADR-0008 change (today onlymainis a public ref). RELEASE-PROCESS now says so; #119's body doesn't yet.🤖 Generated with Claude Code