Skip to content

Hygiene: SECURITY.md, CODE_OF_CONDUCT.md (and LICENSE where missing), emitted from flashyos - #22

Draft
AgenteLabs wants to merge 2 commits into
mainfrom
estate-hygiene
Draft

AgenteLabs wants to merge 2 commits into
mainfrom
estate-hygiene

Conversation

@AgenteLabs

Copy link
Copy Markdown
Owner

Emitted by tools/estate-hygiene-files.mjs in flashyos from one template set the whole estate shares. These files are regenerated, never hand-edited: node tools/estate-hygiene-files.mjs --check <this checkout> in flashyos fails on drift.

  • SECURITY.md — the managed block between the two HTML-comment markers carries the estate's one disclosure route (the address flashy-network publishes at /security/ and /.well-known/security.txt, measured to have MX), the 72-hour acknowledgement window, "default branch only", and the rule that a committed credential is rotated, never removed. Everything below the end marker is this repository's own text, kept verbatim; only the former reporting / contact / what-to-expect sections were replaced, because the address they named was a placeholder or a domain with no MX record and every report sent there had nowhere to land.
  • CODE_OF_CONDUCT.md — Contributor Covenant 2.1, verbatim, with the same contact.
  • LICENSE — only where none existed, the canonical Apache-2.0 text with the holder the estate register names.

Owner lane, not in this PR: enable Private vulnerability reporting on the repository (Settings → Code security), which the SECURITY.md names as the second route.


Generated by Claude Code

… emitted from flashyos

Emitted by tools/estate-hygiene-files.mjs in AgenteLabs/flashyos and
regenerated, never hand-edited. The disclosure route is the one
flashy-network publishes, stated once across the estate; the sections that
named a placeholder or an MX-less address are replaced, and this
repository's own threat model is kept below the managed block.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2LtjRauY7RENs18aztY6V

Copy link
Copy Markdown
Owner Author

Dependency audit is red on main too, not on this PR. This PR adds SECURITY.md and CODE_OF_CONDUCT.md only; npm audit --audit-level=high fails on vitest / @vitest/mocker (GHSA-qxg6-89mg-rqv8, high; GHSA-xp26-3454-mjgp), which is the same failure on the latest main run.

No fix is ported here: Dependabot's #18 bumps vitest to 5.x but also TypeScript 7, ESLint 10 and mongodb 7 in one lockfile, and is itself red on typecheck, lint and the Mongo conformance job. A narrower deps-vitest-audit PR (vitest + @vitest/coverage-v8 only, lockfile regenerated with npm 10.9.8) is being prepared; once it is green its change will be ported onto this branch so the audit passes here.


Generated by Claude Code

…s here

Same two files as PR #23 (package.json, package-lock.json); no-ops once
main carries it. The hygiene files are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2LtjRauY7RENs18aztY6V
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants