Skip to content

Security: menot-you/.github

Security

Report a vulnerability

.github/SECURITY.md

Security Policy

This is the organization-wide default. A repository may override it with its own SECURITY.md.

Reporting a Vulnerability

Do NOT open a public issue. Use the repository's private vulnerability reporting, or the organization's private report form if the repository does not provide one. We acknowledge within 48 hours and aim for a fix or mitigation plan within 7 business days. Please include a description, reproduction steps, and an impact assessment.

Secret Storage

Secrets live in 1Password and are resolved at runtime (op run / op inject / op read) — never committed. Rendered .env* is gitignored; only *.tpl / *.example templates are tracked. SSH keys live in ~/.ssh (chmod 600), never in a repo tree. CI uses GitHub Actions / environment secrets and OIDC, not long-lived tokens.

There aren't any published security advisories