From 085e6933baafaeb83e51723844c27700b70dc11d Mon Sep 17 00:00:00 2001 From: BigJohn-dev Date: Wed, 15 Jul 2026 19:55:40 +0100 Subject: [PATCH] feat: add security policy contact details and create SECURITY-INSIGHTS file --- .github/SECURITY-INSIGHTS.yml | 19 +++++++++++++++++++ README.md | 6 ++++++ SECURITY.md | 2 +- 3 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 .github/SECURITY-INSIGHTS.yml diff --git a/.github/SECURITY-INSIGHTS.yml b/.github/SECURITY-INSIGHTS.yml new file mode 100644 index 00000000..50aff104 --- /dev/null +++ b/.github/SECURITY-INSIGHTS.yml @@ -0,0 +1,19 @@ +name: ChainForge Security Insights + +contact: + email: security@chainforge.app + disclosure: https://github.com/ChainForgee/ChainForge/security/advisories/new + +policy: + url: https://github.com/ChainForgee/ChainForge/blob/main/SECURITY.md + +supported_versions: + - version: latest + status: supported + - version: "1.0" + status: unsupported + +languages: + - rust + - typescript + - python diff --git a/README.md b/README.md index 34fd9dd4..cf41ea04 100644 --- a/README.md +++ b/README.md @@ -156,6 +156,12 @@ For component-specific contribution guidelines, refer to the README in each `app --- +## Security + +To report a vulnerability, email [security@chainforge.app](mailto:security@chainforge.app) or use [GitHub's private vulnerability reporting](https://github.com/ChainForgee/ChainForge/security/advisories/new). Please do not open public issues for security reports. See [SECURITY.md](SECURITY.md) for details. + +--- + ## License This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details. diff --git a/SECURITY.md b/SECURITY.md index 07aebfaf..b22d5193 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -17,7 +17,7 @@ ChainForge handles sensitive humanitarian aid data and recipient PII. We take se ### How to Report -1. **Email**: Send a detailed report to the maintainers via the contact information in the README. +1. **Email**: Send a detailed report to [security@chainforge.app](mailto:security@chainforge.app). 2. **GitHub Private Disclosure**: Use [GitHub's private vulnerability reporting](https://github.com/ChainForgee/ChainForge/security/advisories/new) feature. ### What to Include