mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 08:37:31 +09:00
tym83andClaude
60704530ed
Bring the security documentation in line with controls that are already in place, and add the two coordinated-disclosure items flagged during the incubation due-diligence review. - self-assessment: DCO is enforced by an automated check; private intake is GitHub Private Vulnerability Reporting; OpenSSF passing badge achieved 2026-04-01 (working toward silver); GHSA/PVR framing for advisory history; incident-response now summarized publicly. - SECURITY.md: route reports to Private Vulnerability Reporting with a MAINTAINERS.md fallback; add a 90-day coordinated-disclosure window and a CVSS-based remediation-target table. - CODEOWNERS: document that it encodes the area-scoped Reviewer role, which is intentionally distinct from the MAINTAINERS.md governance roster, and that security reporting is not routed through this file. - Add docs/security/incident-response.md as the public incident runbook. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: tym83 <6355522@gmail.com>
20 lines
1.2 KiB
Plaintext
20 lines
1.2 KiB
Plaintext
# This file encodes the area-scoped Reviewer role from the Contributor Ladder
|
|
# (CONTRIBUTOR_LADDER.md): the handles below have review authority over the
|
|
# matching paths. This is intentionally a different set from the governance
|
|
# roster in MAINTAINERS.md — a Reviewer owns a specific code area, while a
|
|
# Maintainer is responsible for the whole project. The two overlap but are not
|
|
# identical by design. Security reports are NOT routed through this file; see
|
|
# SECURITY.md (GitHub Private Vulnerability Reporting + MAINTAINERS.md).
|
|
|
|
* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu @myasnikovdaniil
|
|
|
|
# The API review gate must not be editable without an API-owner review, or a
|
|
# PR could neuter the detector (it is compiled from the head checkout during
|
|
# bootstrap) and slip a sizeable API change through unreviewed. Scoping these
|
|
# paths to the API owners overrides the catch-all above (last match wins), so
|
|
# changes here require @kvaps or @lllamnyp specifically. Enable "Require review
|
|
# from Code Owners" in branch protection for this to bind.
|
|
/cmd/api-gate/ @kvaps @lllamnyp
|
|
/internal/apigate/ @kvaps @lllamnyp
|
|
/.github/workflows/api-review-gate.yaml @kvaps @lllamnyp
|