← Back to issue list

Security policy

View original Github issue

Metadata

Project
starbase
Number
#82
Type
issue
State
closed
Author
setharnold
Labels
—
Created
Updated
Closed

Current evaluation

Request for a repo security policy was fulfilled by merged PR #356 (commit 4adfa53), which added a Security Engineering-vetted SECURITY.md to starbase with Ubuntu LTS release-cycle and private vulnerability reporting guidance.

Resolution: closed resolved

Reason: PR #356 "docs: add SECURITY.md template" was merged as commit 4adfa53, adding SECURITY.md with release-cycle support and private security advisory reporting guidance. Maintainer sergiusens closed the issue on 2025-02-21 with "Solved with #356", tracking internal ticket CRAFT-3700.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Hello, please consider setting up a security policy for the repository, and populating a SECURITY.md file. These policies and files are useful for security researchers and the general public who would like to report issues in a way to minimize risk. See https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository for more information. Thanks

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Request for a repo security policy was fulfilled by merged PR #356 (commit 4adfa53), which added a Security Engineering-vetted SECURITY.md to starbase with Ubuntu LTS release-cycle and private vulnerability reporting guidance.
stealth/space-bunny-alpha — closed resolved Added a Security Engineering-vetted SECURITY.md with vulnerability-reporting guidance in merged PR #356, commit 4adfa53.
qwen/qwen3.6-35b-a3b — — Resolved by merging pull request #356, which added the requested SECURITY.md file and repository security policy.
qwen/qwen3.6-35b-a3b — — Implemented a security policy via pull request #356, adding a SECURITY.md file to standardize vulnerability reporting.
qwen3.6-35b-a3b-mtp-q6 — — Resolved by merging pull request #356, which added a SECURITY.md file and established a security policy for vulnerability reporting.

Update history

No update history recorded yet.

Related work

  • Likely Fixed By: canonical/starbase#356 (confidence 98%)

    Merged PR adding the SECURITY.md template; commit 4adfa53 and the maintainer's closing comment cite it directly.

  • Related To: .github#6 (confidence 45%)

    Referenced by lengau as the source of org-wide guidance on how projects should adopt security policies; not itself a fix.

Related issues

Issue Project State Summary Similarity
#5324 docs: add security policy snapcraft merged Merged PR #5324 in commit 7a164a2bc, adding SECURITY.md with vulnerability reporting, supported-release, and base/Ubuntu LTS guidance.
78%
#671 docs: add security policy craft-application merged PR #671 merged (commit 251a48a3), adding SECURITY.md to craft-application ported from Starbase's policy. Documents supported versions and directs reports to GitHub private advisories; advisories tab still pending with Canonical security team.
75%
#80 docs: add security policy craft-grammar merged Merged PR #80 in commit 869adcc, adding a 34-line SECURITY.md covering supported versions and private vulnerability reporting.
74%
#356 docs: add SECURITY.md template starbase merged Merged PR #356 (commit 4adfa53) added a Security Engineering-reviewed SECURITY.md template to starbase, documenting vulnerability reporting for CRAFT-3700; tracked issue #82 was closed by it.
73%
#372 docs: add security policy fetch-service merged Merged PR #372 (commit 38d65fb, "docs: add security policy") adding a 32-line SECURITY.md to fetch-service, documenting what counts as a vulnerability, supported versions, and private reporting via GitHub security advisories.
73%
#154 docs: add security policy craft-archives merged PR #154 by bepri added a 34-line SECURITY.md (release cycle scope plus private security report/embargo guidance) for CRAFT-4299; approved by two reviewers and merged as commit 015bbe5.
72%
#329 docs: add security policy craft-cli merged Merged: PR #329 by bepri added SECURITY.md to craft-cli documenting supported release cycle and Canonical private vulnerability reporting; landed as commit 561c533 (CRAFT-4301), approved with 2 reviewers.
71%
#277 Add a SECURITY.md file starbase closed Closed as a duplicate of canonical/starbase#82, which was resolved by merged PR #356 (commit 4adfa53, "docs: add SECURITY.md template") adding a Security Engineering-vetted SECURITY.md.
71%
#837 docs: add security policy rockcraft merged Merged PR #837 (commit 0f44e504) added a real SECURITY.md for rockcraft, replacing the GitHub template (#356/#365) with a policy covering rock authorship, build isolation, supported bases and vulnerability reporting via private security reports.
70%