← Back to issue list

docs: add security policy

View original Github issue

Metadata

Project
craft-application
Number
#671
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

PR #671 merged (commit 251a48a3), adding SECURITY.md to craft-application ported from Starbase's policy. Documents supported versions and directs reports to GitHub private advisories; advisories tab still pending with Canonical security team.

Resolution: closed resolved

Reason: The PR itself was merged into main as commit 251a48a3 ("docs: add security policy (#671)"), adding a 34-line SECURITY.md that now exists in the repository at HEAD with release cycle and reporting-via-private-advisories guidance. It was approved by two reviewers; the only unresolved thread was the out-of-repo request to enable private vulnerability reporting, which does not block the merged docs change.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you followed the guidelines for contributing? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [x] Have you successfully run `make lint && make test`? - [x] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? --- Adds a new security policy from Starbase.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved PR #671 merged (commit 251a48a3), adding SECURITY.md to craft-application ported from Starbase's policy. Documents supported versions and directs reports to GitHub private advisories; advisories tab still pending with Canonical security team.
stealth/space-bunny-alpha — closed resolved Merged #671, adding a Starbase-derived security policy in commit 251a48a3 after approval by two reviewers.
qwen/qwen3.6-35b-a3b — — Merged after approval by two reviewers and passing CI checks. Adds a security policy from Starbase. Maintainers requested enabling the GitHub advisories tab, pending security team feedback.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/starbase#82 (confidence 88%)

    Source of the policy text; the PR description states the new security policy was added 'from Starbase', whose own Security Engineering-vetted SECURITY.md landed in starbase PR #356.

  • Related To: canonical/fetch-service#372 (confidence 62%)

    Sibling Canonical PR adding an equivalent SECURITY.md, indicating a repo-wide rollout of the same security policy template.

  • Related To: canonical/snapcraft#5324 (confidence 58%)

    Sibling Canonical PR adding SECURITY.md (commit 7a164a2bc) as part of the same policy rollout across projects.

Related issues

Issue Project State Summary Similarity
#329 docs: add security policy craft-cli merged Merged: PR #329 by bepri added SECURITY.md to craft-cli documenting supported release cycle and Canonical private vulnerability reporting; landed as commit 561c533 (CRAFT-4301), approved with 2 reviewers.
89%
#274 docs: add security policy craft-store merged Merged canonical/craft-store#274 (commit fff8fa5, CRAFT-4302), adding a 34-line SECURITY.md stating supported versions and pointing reporters to private GitHub security advisories.
87%
#110 docs: add security policy craft-platforms merged Merged #110 in commit 64b8ae2, adding SECURITY.md with supported-version guidance and private vulnerability-reporting instructions (CRAFT-4281).
87%
#154 docs: add security policy craft-archives merged PR #154 by bepri added a 34-line SECURITY.md (release cycle scope plus private security report/embargo guidance) for CRAFT-4299; approved by two reviewers and merged as commit 015bbe5.
86%
#730 docs: add security policy craft-providers merged Merged PR #730 (commit dc8ff23) added SECURITY.md to craft-providers, documenting supported release cycle and how to file a private security report; resolves CRAFT-4780.
86%
#372 docs: add security policy fetch-service merged Merged PR #372 (commit 38d65fb, "docs: add security policy") adding a 32-line SECURITY.md to fetch-service, documenting what counts as a vulnerability, supported versions, and private reporting via GitHub security advisories.
84%
#5324 docs: add security policy snapcraft merged Merged PR #5324 in commit 7a164a2bc, adding SECURITY.md with vulnerability reporting, supported-release, and base/Ubuntu LTS guidance.
84%
#80 docs: add security policy craft-grammar merged Merged PR #80 in commit 869adcc, adding a 34-line SECURITY.md covering supported versions and private vulnerability reporting.
84%
#1037 docs: add security policy craft-parts merged Merged #1037, adding a 34-line security policy for CRAFT-4279 in commit 8ee49ba8.
81%
#356 docs: add SECURITY.md template starbase merged Merged PR #356 (commit 4adfa53) added a Security Engineering-reviewed SECURITY.md template to starbase, documenting vulnerability reporting for CRAFT-3700; tracked issue #82 was closed by it.
81%