← Back to issue list

docs: add SECURITY.md template

View original Github issue

Metadata

Project
starbase
Number
#356
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #356 (commit 4adfa53) added a Security Engineering-reviewed SECURITY.md template to starbase, documenting vulnerability reporting for CRAFT-3700; tracked issue #82 was closed by it.

Resolution: closed resolved

Reason: The PR itself was merged into the default branch as commit 4adfa53 ("docs: add SECURITY.md template (#356)"), landing SECURITY.md in the repo; git log for SECURITY.md confirms that commit introduced the file. Tracked issue starbase#82 "Security policy" was closed by this change.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you followed the guidelines for contributing? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [x] Have you successfully run `make lint && make test`? --- Language was reviewed by the Security Engineering team once already. All content is my own addition except for the text under "Reporting a vulnerability". CRAFT-3700.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #356 (commit 4adfa53) added a Security Engineering-reviewed SECURITY.md template to starbase, documenting vulnerability reporting for CRAFT-3700; tracked issue #82 was closed by it.
stealth/space-bunny-alpha — closed resolved Merged PR #356 (commit 4adfa53), adding a Security Engineering-vetted SECURITY.md template with vulnerability-reporting guidance for CRAFT-3700.
qwen/qwen3.6-35b-a3b — — Merged to add a SECURITY.md template. Approved by three reviewers and vetted by the Security Engineering team. References CRAFT-3700. Adds 46 lines across two files detailing security policies and vulnerability reporting.
qwen3.6-35b-a3b-mtp-q6 — — Merged addition of a SECURITY.md template. Content was reviewed by the Security Engineering team and resolves CRAFT-3700. Integrated directly without comments or requested changes.

Update history

No update history recorded yet.

Related work

  • Likely Fixed By: starbase#82 (confidence 90%)

    Tracked issue 'Security policy' closed by this PR; the same Security Engineering-vetted content added in4adfa53.

  • Related To: canonical/craft-grammar#80 (confidence 55%)

    Sibling repo PR adding the equivalent canonical SECURITY.md security policy template.

  • Related To: canonical/fetch-service#372 (confidence 50%)

    Analogous Canonical-repo PR adding a SECURITY.md with the same vulnerability-reporting template.

  • Related To: starbase#365 (confidence 45%)

    Commit 3fe6515 later touched SECURITY.md while converting repo docs to markdown.

Related issues

Issue Project State Summary Similarity
#277 Add a SECURITY.md file starbase closed Closed as a duplicate of canonical/starbase#82, which was resolved by merged PR #356 (commit 4adfa53, "docs: add SECURITY.md template") adding a Security Engineering-vetted SECURITY.md.
85%
#671 docs: add security policy craft-application merged PR #671 merged (commit 251a48a3), adding SECURITY.md to craft-application ported from Starbase's policy. Documents supported versions and directs reports to GitHub private advisories; advisories tab still pending with Canonical security team.
81%
#154 docs: add security policy craft-archives merged PR #154 by bepri added a 34-line SECURITY.md (release cycle scope plus private security report/embargo guidance) for CRAFT-4299; approved by two reviewers and merged as commit 015bbe5.
80%
#110 docs: add security policy craft-platforms merged Merged #110 in commit 64b8ae2, adding SECURITY.md with supported-version guidance and private vulnerability-reporting instructions (CRAFT-4281).
80%
#329 docs: add security policy craft-cli merged Merged: PR #329 by bepri added SECURITY.md to craft-cli documenting supported release cycle and Canonical private vulnerability reporting; landed as commit 561c533 (CRAFT-4301), approved with 2 reviewers.
80%
#730 docs: add security policy craft-providers merged Merged PR #730 (commit dc8ff23) added SECURITY.md to craft-providers, documenting supported release cycle and how to file a private security report; resolves CRAFT-4780.
79%
#837 docs: add security policy rockcraft merged Merged PR #837 (commit 0f44e504) added a real SECURITY.md for rockcraft, replacing the GitHub template (#356/#365) with a policy covering rock authorship, build isolation, supported bases and vulnerability reporting via private security reports.
78%
#80 docs: add security policy craft-grammar merged Merged PR #80 in commit 869adcc, adding a 34-line SECURITY.md covering supported versions and private vulnerability reporting.
77%
#372 docs: add security policy fetch-service merged Merged PR #372 (commit 38d65fb, "docs: add security policy") adding a 32-line SECURITY.md to fetch-service, documenting what counts as a vulnerability, supported versions, and private reporting via GitHub security advisories.
77%
#1125 Add SECURITY.md to templates charmcraft open Request to add SECURITY.md to charmcraft init templates; root repo has one via starbase but generated charm projects still lack it; maintainer reconsidering scope, Jira CRAFT-3709 open.
76%