Skip to content

Hygiene: SECURITY.md, CODE_OF_CONDUCT.md (and LICENSE where missing), emitted from flashyos - #2

Draft
AgenteLabs wants to merge 1 commit into
mainfrom
estate-hygiene
Draft

AgenteLabs wants to merge 1 commit into
mainfrom
estate-hygiene

Conversation

@AgenteLabs

Copy link
Copy Markdown
Collaborator

Emitted by tools/estate-hygiene-files.mjs in flashyos from one template set the whole estate shares. These files are regenerated, never hand-edited: node tools/estate-hygiene-files.mjs --check <this checkout> in flashyos fails on drift.

  • SECURITY.md — the managed block between the two HTML-comment markers carries the estate's one disclosure route (the address flashy-network publishes at /security/ and /.well-known/security.txt, measured to have MX), the 72-hour acknowledgement window, "default branch only", and the rule that a committed credential is rotated, never removed. Everything below the end marker is this repository's own text, kept verbatim; only the former reporting / contact / what-to-expect sections were replaced, because the address they named was a placeholder or a domain with no MX record and every report sent there had nowhere to land.
  • CODE_OF_CONDUCT.md — Contributor Covenant 2.1, verbatim, with the same contact.
  • LICENSE — only where none existed, the canonical Apache-2.0 text with the holder the estate register names.

Owner lane, not in this PR: enable Private vulnerability reporting on the repository (Settings → Code security), which the SECURITY.md names as the second route.


Generated by Claude Code

… emitted from flashyos

Emitted by tools/estate-hygiene-files.mjs in AgenteLabs/flashyos and
regenerated, never hand-edited. The disclosure route is the one
flashy-network publishes, stated once across the estate; the sections that
named a placeholder or an MX-less address are replaced, and this
repository's own threat model is kept below the managed block.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2LtjRauY7RENs18aztY6V
@vercel

vercel Bot commented Oct 27, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
agentpay Ready Ready Preview Oct 27, 2026 5:48am UTC

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants