Repository navigation
docs: align security response times - #199
Merged
Merged
Conversation
SECURITY.md promised an acknowledgment within 72 hours and a substantive assessment within 7 days. Change the commitments to 5 business days and 14 days, the times the maintainer can keep. The 90-day disclosure window is unchanged. llms-full.txt is regenerated from SECURITY.md. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #199 +/- ##
=======================================
Coverage 94.07% 94.07%
=======================================
Files 148 148
Lines 11729 11729
Branches 2765 2765
=======================================
Hits 11034 11034
Misses 232 232
Partials 463 463 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
🎉 This PR is included in version 0.54.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
SECURITY.mdresponse commitments:The 90-day disclosure window, the no-bounty statement, the contact address and everything else are unchanged.
llms-full.txtis regenerated fromSECURITY.mdwithpnpm llms:generate(the only lines that changed in it are the same two sentences). No other file in the repo (README,docs/) repeats these times.Why
The old times were tighter than the maintainer can reliably keep as a solo maintainer. These are promises the project can keep: a 5-business-day acknowledgment and a 14-day substantive assessment, with the 90-day disclosure window still in place.
Verified
pnpm checkfrom the repo root passes (build, examples typecheck, oxlint, oxfmt, tsc, doc-lint, doc-check, doc-links,llms:check).grepfor72 hours,7 days, and acknowledgment wording across the repo finds onlySECURITY.mdand its generated copy inllms-full.txt.docs/triage.mdstates a separate 3-business-day issue-triage target for public issues; it is not the security commitment and is unchanged.🤖 Generated with Claude Code