docs: give every repo a reporting channel that actually exists - #54
Merged
Conversation
Two of the four Code of Conduct files pointed at GitHub features that are not real: - devrepro-doctor: report "via GitHub private message". GitHub has no private messaging. - local-ai-hardware-bench: report by "opening a private issue tagged `conduct`". GitHub has private *vulnerability reports*; it has no private issues. api-verity-lab gave a profile URL rather than a contact channel. Only tooltrace-bench named an address that works. Someone reporting harassment is the worst possible person to hand a dead end, so all four now carry the same wording: the maintainer's noreply address plus GitHub's real report-abuse form. Worse, and found while checking the above: all four SECURITY.md files direct reporters to GitHub's private vulnerability reporting, and it was **disabled on all four repositories**. Every documented security-disclosure path in this family of projects led to a page the reporter could not use. It is enabled now (a repository setting, so not visible in this diff). The disclosure SLAs also disagreed for the same solo maintainer -- 72h, 72h+7d, 7d, and 7d+30d. Standardized on 7 days to acknowledge and 30 to update, the most conservative of the four, and said plainly why: promising 72 hours when nobody is on call is a promise, not a policy. tests/test_contact_channels_exist.py pins this. It asserts the working address and the report-abuse form are present, that SECURITY.md still names private vulnerability reporting and still warns against public issues, and -- the point of the exercise -- that no document mentions "private message", "private issue" or "report-user functionality" again. Verified by reintroducing the devrepro-doctor wording and watching it fail.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two of the four Code of Conduct files in this family of projects pointed at GitHub features that are not real:
devrepro-doctor: report "via GitHub private message" — GitHub has no private messaging.local-ai-hardware-bench: report by "opening a private issue taggedconduct" — GitHub has private vulnerability reports; it has no private issues.api-verity-labgave a profile URL rather than a contact channel. Onlytooltrace-benchnamed an address that works.Someone reporting harassment is the worst possible person to hand a dead end, so all four now carry the same wording: the maintainer's noreply address plus GitHub's real report-abuse form.
The worse one, found while checking the above
All four
SECURITY.mdfiles direct reporters to GitHub's private vulnerability reporting — and it was disabled on all four repositories. Every documented security-disclosure path in this family of projects led to a page the reporter could not use. It is enabled now; that is a repository setting, so it does not appear in this diff.SLAs
The disclosure SLAs disagreed for the same solo maintainer: 72h, 72h + 7d, 7d, and 7d + 30d. Standardized on 7 days to acknowledge, 30 to update — the most conservative of the four — and the document now says why: promising 72 hours when nobody is on call is a promise, not a policy.
What keeps it fixed
test_contact_channels_exist.pyasserts the working address and report-abuse form are present, thatSECURITY.mdstill names private vulnerability reporting and still warns against public issues, and that no document mentions "private message", "private issue" or "report-user functionality" again. Verified by reintroducing thedevrepro-doctorwording and watching it fail.