Skip to content

Security: community-ports/.github

Security

SECURITY.md

Security Policy

This policy applies to every repository in the Community Ports organization unless a repository overrides it with its own SECURITY.md.

Reporting a vulnerability

Please do not open a public issue for security problems.

Use GitHub's private vulnerability reporting on the affected repository ("Security" tab → "Report a vulnerability"). If that option is not available on the repository, contact the maintainers team through the email on the @community-ports/maintainers members' GitHub profiles.

You can expect an acknowledgement within a few days and a fix or mitigation plan before any public disclosure.

Upstream problems

If the issue is in the upstream product a port talks to (for example the TypeSafe AI API) rather than in the port itself, report it to that project's maintainers.

What every port commits to

  • Signed commits on the default branch
  • CI actions pinned to commit SHAs with read-only tokens
  • Dependency monitoring (Dependabot and Socket) and a license/advisory policy check in CI
  • Credentials never logged; secrets only reachable from the default branch's CI

There aren't any published security advisories