Security policy: replace the dead email fallback with a working channel - #77
Merged
Merged
Conversation
SECURITY.md offered "email the maintainer at the address on the GitHub profile" as the alternative to a private advisory, but neither the MEFORORG org profile nor the maintainer profile publishes an email, so that route went nowhere. GitHub's private reporting also requires an account, leaving reporters without one with no private path at all. Point them at security@messagefoundry.org instead, noting that plain email isn't end-to-end encrypted so the advisory stays preferred for a detailed report, and that the website contact form is not a channel for vulnerability details. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
wshallwshall
enabled auto-merge (squash)
July 30, 2026 18:21
wshallwshall
added a commit
that referenced
this pull request
Jul 30, 2026
Seven commits landed on main. One file conflicted, .github/SECURITY.md, and both sides had independently fixed the SAME defect: two markdown links into docs/security/, a directory absent from the public repo. main (#78) removed the references outright. This branch converted them to plain text and pointed at docs/SECURITY-DOCS-POLICY.md, a page that exists only on this branch and that the owner ratified precisely so those ~145 withheld-path mentions have somewhere to point instead of naming documents a reader cannot find. Resolution takes both: main's tighter sentence structure (em-dash rather than a parenthetical), and this branch's named document plus the policy pointer. A reader now learns the analysis exists, that it is maintainer-internal, and what they can request -- which is the whole point of the policy page. main's other change to the file, a working security@ address replacing the dead "email the maintainer at the address on the GitHub profile" fallback (#77), came through untouched and is strictly better than what either side had. Note the five docs/ files a review workflow is currently editing were NOT touched by main and remain uncommitted and intact; this merge deliberately stages only the conflicted file. Verified: 0 conflict markers; the new security@ address present; the policy pointer present twice; 4,639 relative links across 414 files resolve.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
SECURITY.mdoffered "email the maintainer at the address on the GitHub profile" as the alternative to a private advisory — but neither theMEFORORGorg profile nor the maintainer profile publishes an email (email: nullon both via the API), so that route went nowhere.GitHub's private vulnerability reporting also requires the reporter to have a GitHub account. Between the two, a reporter without an account — a hospital security team, say — had no working private path at all, only the non-detail public-issue workaround.
Change
Point them at
security@messagefoundry.org(confirmed valid by the maintainer), with two caveats stated plainly:Private vulnerability reporting is already enabled on this repo, so the advisory form itself needed no change.
Companion PR on the website (messagefoundry-website#94) publishes this channel on
security.html, which previously claimed a private reporting channel without linking to one.🤖 Generated with Claude Code