Skip to content

Add security policy #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DivitMittal merged 1 commit into from
Jul 7, 2026
Merged

Add security policy #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# Security Policy

Thank you for helping keep CiteStage and its users safe.

## Supported Versions

CiteStage is currently a research/MVP artifact. Security fixes are accepted for the `main` branch and the latest tagged release, if one exists.

## Reporting a Vulnerability

Please do not report security vulnerabilities through public GitHub issues.

To report a vulnerability, contact the maintainer directly by email or open a private GitHub security advisory if the repository has advisories enabled. Include:

- A concise description of the issue and its impact.
- Steps to reproduce, proof-of-concept corpus/query data, or affected files.
- Whether the issue can expose private corpus material, traces, generated reports, local files, or CI credentials.
- Any suggested mitigation or patch, if available.

The maintainer will acknowledge reports as soon as possible and coordinate a fix or disclosure timeline based on severity.

## Security Expectations

- Never commit secrets, private corpora, private traces, generated reports with sensitive excerpts, or `.env` files.
- Keep fixture-based evaluation deterministic and safe to run locally and in CI.
- Redact sensitive corpus excerpts from bug reports, screenshots, traces, and diagnosis output.
- Treat StageTrace JSON, repair plans, and report artifacts as potentially sensitive when they come from private documentation.
- Prefer least-privilege GitHub tokens and CI permissions when adding workflows or integrations.

## Scope

In scope:

- Secret exposure in examples, corpora, traces, reports, logs, or CI output.
- Unsafe handling of private corpus content or generated diagnosis artifacts.
- Vulnerabilities in CLI behavior that can overwrite unexpected files, read secrets, or mis-handle untrusted corpus input.
- Supply-chain concerns in build, Nix, Cargo, or APM metadata.

Out of scope:

- Publicly known dependency advisories without a CiteStage-specific exploit path.
- Findings that require malicious local shell access beyond the repository's documented command surface.
- Availability-only reports against public services not controlled by this project.
Loading