Enhance SECURITY.md with detailed security policy - #16
Conversation
Expanded the security policy to include supported versions, reporting methods, response timelines, and best practices for contributors.
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
This PR adds a comprehensive SECURITY.md file covering vulnerability reporting procedures, response timelines, and security best practices. The content is well-structured and appropriate for a post-quantum cryptography project.
Critical Issue Found:
- The "Direct Contact" reporting option (line 23) lacks a functional email address, making it impossible for users to report vulnerabilities through this method
Action Required:
Add a valid security contact email address or remove the incomplete direct contact option to ensure security vulnerabilities can be properly reported.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| Fill in the advisory form with as much detail as possible | ||
|
|
||
| Option 2 — Direct Contact | ||
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. |
There was a problem hiding this comment.
🛑 Security Reporting Defect: The direct contact method is incomplete and non-functional. No email address is provided, preventing users from reporting security vulnerabilities through this channel. Add a valid contact email address or remove this option entirely.
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. | |
| If GitHub's advisory system is unavailable, email the maintainer directly at security@example.com. Include [SECURITY] post-quantum-studio in the subject line. |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new SECURITY.md file outlining the project's security policy, including vulnerability reporting procedures, response timelines, and security best practices. The review feedback focuses on improving the document's formatting and usability on GitHub. Key suggestions include using proper Markdown heading syntax, converting tab-separated lists into standard Markdown tables, providing a contact email address, and adding active hyperlinks to the references section.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| Security Policy | ||
| Supported Versions |
There was a problem hiding this comment.
The document title and section headers are currently written as plain text. Use Markdown heading syntax (e.g., # and ##) to establish a proper document hierarchy, which improves readability and accessibility.
| Security Policy | |
| Supported Versions | |
| # Security Policy | |
| ## Supported Versions |
| Version Supported | ||
| main ✅ Active support | ||
| Older branches ❌ Not supported |
There was a problem hiding this comment.
The supported versions list is formatted with tabs, which will not render as a table in GitHub Markdown. Use standard Markdown table syntax to ensure it renders correctly.
| Version Supported | |
| main ✅ Active support | |
| Older branches ❌ Not supported | |
| | Version | Supported | | |
| | --- | --- | | |
| | main | ✅ Active support | | |
| | Older branches | ❌ Not supported | |
| Option 2 — Direct Contact | ||
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. |
There was a problem hiding this comment.
The direct contact option mentions emailing the maintainer but does not provide an email address or a link to where it can be found. Please add a placeholder or a specific email address.
| Option 2 — Direct Contact | |
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. | |
| ### Option 2 — Direct Contact | |
| If GitHub's advisory system is unavailable, email the maintainer directly at security@example.com. Include [SECURITY] post-quantum-studio in the subject line. |
| Stage Target Timeframe | ||
| Initial acknowledgment Within 48 hours | ||
| Severity assessment Within 5 business days | ||
| Patch / mitigation Within 14–30 days (severity-dependent) | ||
| Public disclosure After patch is released and verified |
There was a problem hiding this comment.
The response timeline is formatted with tabs, which will not render as a table in GitHub Markdown. Use standard Markdown table syntax to ensure it renders correctly.
| Stage Target Timeframe | |
| Initial acknowledgment Within 48 hours | |
| Severity assessment Within 5 business days | |
| Patch / mitigation Within 14–30 days (severity-dependent) | |
| Public disclosure After patch is released and verified | |
| | Stage | Target Timeframe | | |
| | --- | --- | | |
| | Initial acknowledgment | Within 48 hours | | |
| | Severity assessment | Within 5 business days | | |
| | Patch / mitigation | Within 14–30 days (severity-dependent) | | |
| | Public disclosure | After patch is released and verified | |
| References | ||
| NIST Post-Quantum Cryptography Standardization | ||
|
|
||
| NIST FIPS 203 (ML-KEM) | ||
|
|
||
| NIST FIPS 204 (ML-DSA) | ||
|
|
||
| NIST FIPS 205 (SLH-DSA) | ||
|
|
||
| GitHub Private Security Advisories |
There was a problem hiding this comment.
The references section contains plain text names of standards and resources. Converting these to active hyperlinks makes it much easier for readers to access the official specifications.
| References | |
| NIST Post-Quantum Cryptography Standardization | |
| NIST FIPS 203 (ML-KEM) | |
| NIST FIPS 204 (ML-DSA) | |
| NIST FIPS 205 (SLH-DSA) | |
| GitHub Private Security Advisories | |
| ## References | |
| - [NIST Post-Quantum Cryptography Standardization](https://csrc.nist.gov/projects/post-quantum-cryptography) | |
| - [NIST FIPS 203 (ML-KEM)](https://csrc.nist.gov/publications/detail/fips/203/final) | |
| - [NIST FIPS 204 (ML-DSA)](https://csrc.nist.gov/publications/detail/fips/204/final) | |
| - [NIST FIPS 205 (SLH-DSA)](https://csrc.nist.gov/publications/detail/fips/205/final) | |
| - [GitHub Private Security Advisories](https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/about-repository-security-advisories) |
There was a problem hiding this comment.
Pull request overview
This PR adds a new SECURITY.md to document the project’s security policy, including supported versions, vulnerability reporting guidance, response timelines, and contributor best practices.
Changes:
- Introduces a security policy document with reporting instructions and expected response timelines.
- Defines scope/out-of-scope items and contributor-facing security best practices.
- Documents (and/or proposes) dependency scanning and disclosure acknowledgments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Security Policy | ||
| Supported Versions | ||
| The following versions of post-quantum-studio are currently receiving security updates: | ||
|
|
||
| Version Supported | ||
| main ✅ Active support | ||
| Older branches ❌ Not supported |
| Option 2 — Direct Contact | ||
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. |
|
|
||
| Never commit secrets — API keys, private keys, or seed material must never be committed. Use .env files (gitignored) or secrets managers. | ||
|
|
||
| Pin dependencies — Use exact versions in package.json and review package-lock.json diffs carefully. |
| Dependency Scanning | ||
| This repository uses automated tooling to detect vulnerable dependencies: | ||
|
|
||
| Dependabot — Monitors npm dependencies for known CVEs | ||
|
|
||
| CodeQL — Static analysis for JavaScript/TypeScript security patterns | ||
|
|
||
| Trivy — Container and filesystem vulnerability scanning (if Docker is added) | ||
|
|
||
| If you identify a dependency issue not caught by these tools, please report it per the process above. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 34dae8038e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Fill in the advisory form with as much detail as possible | ||
|
|
||
| Option 2 — Direct Contact | ||
| If GitHub's advisory system is unavailable, email the maintainer directly. Include [SECURITY] post-quantum-studio in the subject line. |
There was a problem hiding this comment.
When GitHub private disclosure is unavailable or disabled, this fallback tells reporters to email the maintainer but does not provide any address or alias in the policy. In that scenario, someone following the earlier “do not open a public issue” instruction has no usable private reporting path, so please add a concrete security contact or remove this fallback.
Useful? React with 👍 / 👎.
| Audit new crypto code — Any new cryptographic implementation should include a reference to the specification it implements. | ||
|
|
||
| Dependency Scanning | ||
| This repository uses automated tooling to detect vulnerable dependencies: |
There was a problem hiding this comment.
This says the repository uses automated dependency/security tooling, but I checked the repo tree and there is no .github/dependabot.yml, CodeQL workflow, Trivy workflow/config, or other scanner setup; the existing README roadmap also lists dependency scanning as future work. Until those configs are added, this gives contributors and users false assurance that dependency CVEs are being monitored automatically.
Useful? React with 👍 / 👎.
|
Closing as superseded by #24, which bundles the CI workflow and SECURITY.md. Reopen if needed. |
Expanded the security policy to include supported versions, reporting methods, response timelines, and best practices for contributors.