From 66c5a31056c868e7d2328740c6b46b09c7bb0bd8 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Wed, 28 Oct 2026 18:32:20 +0100 Subject: [PATCH] =?UTF-8?q?docs:=20organisation=20security=20policy=20?= =?UTF-8?q?=E2=80=94=20report=20privately=20via=20GitHub=20vulnerability?= =?UTF-8?q?=20reporting?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G5qpB7zvxLvdrvn5YRyj4R --- SECURITY.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5d71d7a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,33 @@ +# Security policy + +This policy applies to every repository in the PulseEngine organisation that does not have its own `SECURITY.md`. + +PulseEngine is a WebAssembly Component Model engine for safety-critical systems. It is work in progress, and no part of it is certified for production use. We still want to hear about security problems early. + +## Reporting a vulnerability + +Report it privately through GitHub: + +1. Open the affected repository on GitHub. +2. Go to the **Security** tab and choose **Report a vulnerability**. +3. Describe the problem, the affected version or commit, and how to reproduce it if you can. + +Please do **not** open a public issue, pull request or discussion for a vulnerability. If you are not sure which repository is affected, report it in the one that seems closest. We will move it if needed. + +## What to expect + +- We confirm receipt within a few working days. The project is run by a small team, so please allow for that. +- We assess the report and keep you informed in the private advisory thread. +- We fix the problem and publish a GitHub Security Advisory, with credit if you want it. + +## Scope + +In scope: + +- the engine and its tools (for example meld, loom, synth, kiln, sigil, rivet, spar, witness); +- their release artifacts and CI workflows; +- the `pulseengine-claude` plugin published from `pulseengine/pulseengine.eu`. + +Out of scope: + +- forks of third-party projects in this organisation. Report those upstream.