From dc820aaa4c05ccbf610a13e06f483021047b9bbb Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Wed, 29 Apr 2026 23:22:07 +0200 Subject: [PATCH] docs(security): address review feedback on PR #740 - SECURITY.md: add response SLA (5 business days / 30 days) - bug_report.yml: scope the Docker log command to Docker installs - question.yml: align deployment_mode catch-all wording with bug_report.yml Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/ISSUE_TEMPLATE/bug_report.yml | 7 +++++-- .github/ISSUE_TEMPLATE/question.yml | 2 +- SECURITY.md | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 56ac08e9..99e9c078 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -49,8 +49,11 @@ body: attributes: label: Logs and error output description: | - Include the full error message / stack trace from the MCP server, and any relevant entries from - `docker compose exec app cat /var/www/html/data/nextcloud.log | jq | tail` (Nextcloud side). + Include the full error message / stack trace from the MCP server. + If running with Docker, also include any relevant entries from + `docker compose exec app cat /var/www/html/data/nextcloud.log | jq | tail` + (Nextcloud side). For other install methods, attach the equivalent + Nextcloud log excerpt if available. Redact tokens, passwords, and personal data. render: shell validations: diff --git a/.github/ISSUE_TEMPLATE/question.yml b/.github/ISSUE_TEMPLATE/question.yml index 56f2be2a..fad314b5 100644 --- a/.github/ISSUE_TEMPLATE/question.yml +++ b/.github/ISSUE_TEMPLATE/question.yml @@ -51,6 +51,6 @@ body: - Login Flow v2 - OAuth / OIDC (Nextcloud user_oidc) - OAuth / OIDC (external IdP, e.g. Keycloak) - - Not yet decided + - Other / not sure validations: required: true diff --git a/SECURITY.md b/SECURITY.md index 1ada7961..583a2b4c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -27,4 +27,4 @@ Whichever channel you use, please include as much of the following as you can to - The version(s) of the project affected - Any known mitigations or workarounds -We will acknowledge receipt and work with you on coordinated disclosure. +We aim to acknowledge within 5 business days and provide a fix or mitigation timeline within 30 days, and will work with you on coordinated disclosure.