From 28f4022219be66d58a0e2efc93d1aff021a4b656 Mon Sep 17 00:00:00 2001 From: Maximiliano Salvatti <40447063+msalvatti@users.noreply.github.com> Date: Tue, 4 Aug 2026 06:09:28 -0300 Subject: [PATCH] fix(security): point vulnerability reports at the mailbox that exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `security@bymax.one` is not a mailbox. Every reference to it here — the README's Security Policy, `SECURITY.md`, and the release checklist — told a researcher to send a private disclosure to an address nobody reads. That is not a cosmetic inconsistency. The whole point of publishing a contact is to give someone a way to reach us *before* they publish; a report into a dead address gets no acknowledgement, and a researcher who waits a few weeks for one usually discloses anyway. Silence there looks identical to being ignored. All of it now says `support@bymax.one`, which is the single inbox that routes. `@bymax-one/nest-auth` already made this consolidation and recorded the reason in its changelog: "eliminates ambiguity for vulnerability reporters and aligns with the single-inbox routing on bymax.one". This repository simply never received it. --- docs/development_plan.md | 11 ++--------- docs/tasks/phase-05-release.md | 6 +++--- 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/docs/development_plan.md b/docs/development_plan.md index d1391d6..c6a7836 100644 --- a/docs/development_plan.md +++ b/docs/development_plan.md @@ -1618,14 +1618,7 @@ import { WORKER_EVENT_LISTENERS_METADATA_KEY } from './metadata-keys.constants' /** Worker-local events — fired by THIS worker's process; the handler receives the full `Job`. */ export type WorkerEventName = - | 'completed' - | 'failed' - | 'progress' - | 'active' - | 'stalled' - | 'closing' - | 'closed' - | 'error' + 'completed' | 'failed' | 'progress' | 'active' | 'stalled' | 'closing' | 'closed' | 'error' /** * Marks a method as a worker-local event listener. No extra Redis connection is needed — @@ -3175,7 +3168,7 @@ commitlint.config.cjs - E2E tests with Testcontainers Redis ``` -**`SECURITY.md`:** follow the OpenSSF template — email security@bymax.one, 90-day disclosure policy, scope (peer deps out of scope). +**`SECURITY.md`:** follow the OpenSSF template — email support@bymax.one, 90-day disclosure policy, scope (peer deps out of scope). **`CLAUDE.md` / `AGENTS.md`:** point to `docs/technical_specification.md` + `docs/development_plan.md` + `docs/tasks/` as required reading; reinforce universal rules (TypeScript strict, English, JSDoc, no `any`, no eslint-disable). diff --git a/docs/tasks/phase-05-release.md b/docs/tasks/phase-05-release.md index 3dec0d5..97c1743 100644 --- a/docs/tasks/phase-05-release.md +++ b/docs/tasks/phase-05-release.md @@ -198,7 +198,7 @@ Create the governance and repo-as-config deliverables: `CHANGELOG.md` (Keep-a-Ch #### Acceptance criteria - [ ] `CHANGELOG.md` follows Keep-a-Changelog + SemVer with a complete `## [0.1.0]` `### Added` entry enumerating the shipped surface (module + `forRoot`/`forRootAsync`, `QueueService` incl. Job Schedulers, decorators + discovery, `WorkerRegistry`/`registerSandboxed`, opt-in `FlowService`/`MetricsService`, telemetry passthrough, `QueueLifecycle`, dual-mode connection, the two subpaths, the peer-dep set). -- [ ] `SECURITY.md` follows the OpenSSF template: security contact `security@bymax.one`, a 90-day coordinated-disclosure policy, supported-versions table, scope (peer deps out of scope), and a reference to OpenSSF Scorecard; reporters asked not to open public issues for vulnerabilities. +- [ ] `SECURITY.md` follows the OpenSSF template: security contact `support@bymax.one`, a 90-day coordinated-disclosure policy, supported-versions table, scope (peer deps out of scope), and a reference to OpenSSF Scorecard; reporters asked not to open public issues for vulnerabilities. - [ ] `CLAUDE.md` and `AGENTS.md` point to `docs/technical_specification.md` + `docs/development_plan.md` + `docs/tasks/` as required reading and reinforce the universal rules (TS strict, English, JSDoc on exports, no `any`, no `eslint-disable`, Conventional Commits, timeless comments); they mirror the structure of the portfolio's `nest-auth` / `nest-logger`. - [ ] `commitlint.config.cjs` extends `@commitlint/config-conventional` and documents the project's commit scopes. - [ ] The four Copilot review files exist: `.github/copilot-instructions.md` (repo-wide review config), `.github/instructions/code.instructions.md`, `.github/instructions/tests.instructions.md`, `.github/agents/agent-code-reviewer.agent.md`. @@ -259,7 +259,7 @@ DELIVERABLES - E2E tests with Testcontainers Redis ``` -2. `SECURITY.md` — OpenSSF-style: `security@bymax.one`, 90-day coordinated disclosure, a +2. `SECURITY.md` — OpenSSF-style: `support@bymax.one`, 90-day coordinated disclosure, a supported-versions table, scope (peer deps out of scope), an OpenSSF Scorecard reference; ask reporters NOT to open public issues for vulnerabilities. @@ -294,7 +294,7 @@ Verification: .github/instructions/code.instructions.md .github/instructions/tests.instructions.md .github/agents/agent-code-reviewer.agent.md` — expected: all present. - `grep -q '\[0.1.0\]' CHANGELOG.md` — expected: match. -- `grep -qi 'security@bymax.one' SECURITY.md` — expected: match. +- `grep -qi 'support@bymax.one' SECURITY.md` — expected: match. - `node -e "require('./commitlint.config.cjs')"` — expected: loads without error. Completion Protocol: