Skip to content

SECURITY.md: private vulnerability reporting - #132

Merged
wfaithfull merged 3 commits into
mainfrom
security-policy
Oct 29, 2026
Merged

wfaithfull merged 3 commits into
mainfrom
security-policy

Conversation

@wfaithfull

Copy link
Copy Markdown
Contributor

Owner decision (2026-10-29), part of 0.9.0 (#103).

  • SECURITY.md:
    • asks for reports through GitHub's private vulnerability reporting, which is already enabled on the repository;
    • says what to include and what happens next;
    • says that until 1.0, fixes go into the latest release only;
    • defines what counts as a vulnerability, by reference to DESIGN.md §7 and docs/security.md.
  • docs/security.md:
    • "Reporting a vulnerability" now points to SECURITY.md;
    • the 42501 refusal that confirms a graph exists and names its owner is now documented as by design, matching Postgres's own "permission denied for table …", and taken off the known gaps.
  • README: the Documentation list links SECURITY.md.

For the owner to confirm: the response times in SECURITY.md are a commitment on ExaDev's behalf: acknowledge within 3 working days, plan within 10. Change them if they don't fit.

Merge order: a CHANGELOG line follows once #123 (release 0.8.0) has merged and the 0.9.0 section exists. This may conflict with #129's docs/security.md edits; I'll resolve that.


Generated by Claude Code

Owner decision (2026-10-29): a security policy with a private channel,
which a managed provider expects before taking an extension on. Private
vulnerability reporting is already enabled on the repository.

docs/security.md now points to it, and records the other decision: the
42501 refusal that confirms a graph exists and names its owner stays, as
Postgres's own permission errors confirm a table exists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Rxfe2L3iVjSwSBPdUu1Ke
Resolves README.md and docs/security.md against main. CHANGELOG: adds
SECURITY.md under 0.9.0, and moves the entries that #126, #128 and #129
added to 0.8.0 after its release into 0.9.0, so 0.8.0's section matches
the v0.8.0 tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Rxfe2L3iVjSwSBPdUu1Ke
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Rxfe2L3iVjSwSBPdUu1Ke
@wfaithfull
wfaithfull merged commit dc9a73f into main Oct 29, 2026
24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants