From f9ad8a9b1de97fa2acf0c8d0f2de58e408f74323 Mon Sep 17 00:00:00 2001 From: wshallwshall Date: Thu, 30 Jul 2026 13:27:31 -0500 Subject: [PATCH] Security policy: drop two links to docs absent from the public repo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SECURITY.md cited docs/security/SOUP-DEPENDENCY-HANDLING.md for the reachability criteria and docs/security/DEP-CVE-RUNBOOK.md for the step-by-step CVE response. Neither is in the public tree — docs/security/ does not exist on main at all — so both rendered as 404s for the only audience this file has. Keep the substance (the reachability test is already stated inline) and drop the dead pointers. Every remaining reference in the file resolves: docs/SECURITY.md and docs/SERVICE.md are both present. Co-Authored-By: Claude Opus 5 --- .github/SECURITY.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 572037de..c8054d87 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -60,9 +60,8 @@ is *not* a contradiction of the ≤7-day own-code window above): else's library, so the SLA measures how fast we adopt the fix once it exists. - **Exploitation pressure sets priority, not CVSS alone.** We triage **KEV-first** (on CISA's Known-Exploited-Vulnerabilities list → patch now), then **EPSS** (≥ 0.7 = imminent), with **CVSS only - as a tiebreaker**, and we weigh **reachability** (is the package installed in a shipped profile, wired - into a running graph, and egress-reachable? — see - [`docs/security/SOUP-DEPENDENCY-HANDLING.md`](../docs/security/SOUP-DEPENDENCY-HANDLING.md)). + as a tiebreaker**, and we weigh **reachability** — is the package installed in a shipped profile, + wired into a running graph, and egress-reachable? | Class | Trigger | Target (from upstream-fix availability) | |---|---|---| @@ -76,7 +75,7 @@ is *not* a contradiction of the ≤7-day own-code window above): leave the affected extra uninstalled, or tighten the egress allow-list — and track to the fix. Detection feeds this lane automatically: blocking `pip-audit`/`npm-audit` against the hash-locked tree, a **daily** `security.yml` cron (a CVE against an unchanged pin is caught in ~24h), and grouped Dependabot security -PRs. The step-by-step response is [`docs/security/DEP-CVE-RUNBOOK.md`](../docs/security/DEP-CVE-RUNBOOK.md). +PRs. ## Scope notes