From d6362dc77363985f777f75633ab6dd336616e0f3 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Wed, 29 Apr 2026 23:09:39 +0200 Subject: [PATCH] docs(security): prefer GitHub private vulnerability reporting Surface GitHub's native private reporting workflow as the primary disclosure channel, with security@astrolabecloud.com kept as a fallback for reporters without a GitHub account. Updates SECURITY.md, the README Security section, the issue-template config link, and the bug-template warning banner. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- .github/ISSUE_TEMPLATE/config.yml | 6 +++--- README.md | 2 +- SECURITY.md | 22 +++++++++++++++++----- 4 files changed, 22 insertions(+), 10 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index e7c87181..56ac08e9 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -11,7 +11,7 @@ body: **Before submitting**, please check that: - You're running a recent version (`uvx nextcloud-mcp-server --version` or check the Docker tag). - The issue isn't already reported in [open issues](https://github.com/cbcoutinho/nextcloud-mcp-server/issues). - - Security issues should **not** be filed here — see [SECURITY.md](https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md). + - Security issues should **not** be filed here — use [private vulnerability reporting](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new) or see [SECURITY.md](https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md). - type: textarea id: summary diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 820dc0af..22632cc8 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,8 +1,8 @@ blank_issues_enabled: false contact_links: - - name: Security vulnerability - url: https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md - about: Do not file security issues publicly. Email security@astrolabecloud.com — see SECURITY.md. + - name: Security vulnerability (private report) + url: https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new + about: Do not file security issues publicly. Use GitHub's private vulnerability reporting, or see SECURITY.md for the email fallback. - name: Question or discussion url: https://github.com/cbcoutinho/nextcloud-mcp-server/discussions about: For general questions, deployment help, or open-ended discussion, please use Discussions instead of opening an issue. diff --git a/README.md b/README.md index b87c0d20..f0443e5c 100644 --- a/README.md +++ b/README.md @@ -248,7 +248,7 @@ This project takes security seriously: - No credential storage in OAuth mode - Regular security assessments -Found a security issue? **Do not open a public GitHub issue.** Please report it privately by emailing **security@astrolabecloud.com**. See [SECURITY.md](./SECURITY.md) for details. +Found a security issue? **Do not open a public GitHub issue.** Use GitHub's [private vulnerability reporting](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new), or email **security@astrolabecloud.com** if you can't use GitHub. See [SECURITY.md](./SECURITY.md) for details. ## License diff --git a/SECURITY.md b/SECURITY.md index 4fd8448f..1ada7961 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,17 +2,29 @@ ## Reporting a Vulnerability -**Please do not report security vulnerabilities through public GitHub issues.** +**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.** -If you discover a security vulnerability in this project, report it privately by emailing: +### Preferred: GitHub Private Vulnerability Reporting + +Use GitHub's built-in private reporting workflow: + +➡️ **[Report a vulnerability](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new)** + +This opens a private draft security advisory visible only to the repository maintainers. You can also reach the same form from the **Security** tab → **Report a vulnerability**. + +### Fallback: Email + +If you cannot use GitHub's private reporting (for example, you don't have a GitHub account), email: **security@astrolabecloud.com** -Please include as much of the following information as possible to help us triage your report: +### What to include + +Whichever channel you use, please include as much of the following as you can to help us triage: - A description of the vulnerability and its potential impact -- Steps to reproduce the issue (proof-of-concept code, if applicable) +- Steps to reproduce (proof-of-concept code, if applicable) - The version(s) of the project affected - Any known mitigations or workarounds -We will acknowledge receipt of your report and work with you on coordinated disclosure. +We will acknowledge receipt and work with you on coordinated disclosure.