Add SECURITY.md to templates
Metadata
Current evaluation
Request to add SECURITY.md to charmcraft init templates; root repo has one via starbase but generated charm projects still lack it; maintainer reconsidering scope, Jira CRAFT-3709 open.
Suggested action: keep open
Reason: The issue is valid and has been triaged: lengau noted it would be handled via starbase#82, and a Jira ticket (CRAFT-3709) was created. However, the starbase SECURITY.md template (PR #356) was merged and applied to charmcraft's root repo, yet the init templates (kubernetes__ubuntu@24.04, machine__ubuntu@24.04) still contain no SECURITY.md and tests/integration/commands/test_init.py does not list one. sed-i's 2024 comment questions whether this belongs in charmcraft templates at all, so the scope remains under discussion rather than ready to implement.
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| ~deepseek/deepseek-pro-latest |
Impact:
30
Quick Win:
11
Complexity:
35
Confidence:
60
Actionability:
55
|
keep open | Request to add SECURITY.md to charmcraft init templates; root repo has one via starbase but generated charm projects still lack it; maintainer reconsidering scope, Jira CRAFT-3709 open. | |
| stealth/space-bunny-alpha |
Impact:
35
Quick Win:
11
Complexity:
30
Confidence:
92
Actionability:
45
|
keep open | Adding security policies to generated charm templates remains unresolved: Starbase supplied a vetted policy, but Charmcraft init output still lacks SECURITY.md and maintainers are reconsidering its scope. | |
| qwen/qwen3.6-35b-a3b |
Impact:
20
Quick Win:
7
Complexity:
10
Confidence:
60
Actionability:
40
|
needs triage | Request to add SECURITY.md to charmcraft templates or link to company-wide policy; discussed but unresolved with no labels or assignee. | |
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
40
Quick Win:
34
Staleness:
85
Complexity:
15
Confidence:
80
Support Request:
20
|
close stale | Request to add SECURITY.md to templates. Work completed in starbase#356 (merged). Issue is stale with no activity since Nov 2024. | |
| qwen/qwen3.8-27b |
Impact:
25
Quick Win:
18
Staleness:
65
Complexity:
30
Confidence:
72
Support Request:
10
|
keep open | Request to add SECURITY.md to charmcraft templates. Acknowledged by maintainer as team-wide effort via starbase. Starbase#356 merged the template, but charmcraft templates still lack it. Author questioned premise in Nov 2024; unresolved. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
85
Complexity:
10
Confidence:
85
Support Request:
10
|
close stale | Suggests adding a SECURITY.md file to project templates for standard security practices. Currently open but inactive for over a year, with a Jira ticket created and team-wide handling referenced elsewhere. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
90
Complexity:
10
Confidence:
85
Support Request:
10
|
close stale | Request to add a SECURITY.md file to project templates, noted as being handled team-wide via another issue and questioned for relevance to this specific project. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
10
Confidence:
85
Support Request:
10
|
close stale | Suggests adding a SECURITY.md file to templates or linking to a company-wide policy. Deferred to a team-wide starbase initiative and cross-posted elsewhere, with recent discussion questioning its relevance to this repo. |
Update history
No update history recorded yet.
Related work
-
Related To:
starbase#356
(confidence 80%)
Merged PR adding a Security Engineering-vetted SECURITY.md template; lengau said it would be applied via a starbase update, but charmcraft init templates still lack the file.
-
Related To:
starbase#82
(confidence 70%)
Team-wide security policy issue referenced by lengau as the path for resolving this charmcraft issue.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #356 docs: add SECURITY.md template | starbase | merged | Merged PR #356 (commit 4adfa53) added a Security Engineering-reviewed SECURITY.md template to starbase, documenting vulnerability reporting for CRAFT-3700; tracked issue #82 was closed by it. | |
| #277 Add a SECURITY.md file | starbase | closed | Closed as a duplicate of canonical/starbase#82, which was resolved by merged PR #356 (commit 4adfa53, "docs: add SECURITY.md template") adding a Security Engineering-vetted SECURITY.md. |