From e3f3b89c4a0f65f2c6ce4b6491e641a5f5c51b07 Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Mon, 2 Nov 2026 17:56:26 +0100 Subject: [PATCH] feat(security): add structured vulnerability reporting form Signed-off-by: Adrien Langou --- .../skills/create-security-advisory/SKILL.md | 3 + .../assets/advisory-template.md | 5 +- .github/ISSUE_TEMPLATE/config.yml | 4 +- .github/VULNERABILITY_REPORT.yml | 73 +++++++++++++++++++ SECURITY.md | 2 +- 5 files changed, 82 insertions(+), 5 deletions(-) create mode 100644 .github/VULNERABILITY_REPORT.yml diff --git a/.agents/skills/create-security-advisory/SKILL.md b/.agents/skills/create-security-advisory/SKILL.md index 9bd57b76d6..9e2671006a 100644 --- a/.agents/skills/create-security-advisory/SKILL.md +++ b/.agents/skills/create-security-advisory/SKILL.md @@ -10,6 +10,9 @@ metadata: Prepare every report with the required [advisory template](assets/advisory-template.md); keep GitHub metadata separate from its description. +Keep the [private reporting form](../../../.github/VULNERABILITY_REPORT.yml) and +the template aligned when changing report requirements. + ## Scope and privacy Follow the repository's current [SECURITY.md](../../../SECURITY.md). This contributor diff --git a/.agents/skills/create-security-advisory/assets/advisory-template.md b/.agents/skills/create-security-advisory/assets/advisory-template.md index 56b6e99ff5..ea50eacd79 100644 --- a/.agents/skills/create-security-advisory/assets/advisory-template.md +++ b/.agents/skills/create-security-advisory/assets/advisory-template.md @@ -28,8 +28,9 @@ revision. State who verified what and any failed attempts or limitations.}} ## Additional details {{Optional: include supported details that help review, such as the root cause, -severity rationale and CVSS/CWE, a proposed fix or verified workaround, known -unaffected deployments, or a related private PR. Omit this section if none are available.}} +severity rationale and CVSS/CWE, existing CVE identifiers, disclosure deadlines, +a proposed fix or verified workaround, known unaffected deployments, or a related +private PR. Omit this section if none are available.}} ## Open questions diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 0f6486fde8..56167f85c9 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -15,5 +15,5 @@ contact_links: url: https://github.com/NVIDIA/OpenShell/blob/main/SECURITY.md about: > Do not report security vulnerabilities through GitHub issues. Follow - the disclosure process in SECURITY.md — report through the NVIDIA PSIRT - web form or email psirt@nvidia.com. + the disclosure process in SECURITY.md — use GitHub's private vulnerability + reporting form. diff --git a/.github/VULNERABILITY_REPORT.yml b/.github/VULNERABILITY_REPORT.yml new file mode 100644 index 0000000000..409ab934e2 --- /dev/null +++ b/.github/VULNERABILITY_REPORT.yml @@ -0,0 +1,73 @@ +# Keep the sections and prompts aligned with +# .agents/skills/create-security-advisory/assets/advisory-template.md. +name: Private vulnerability report +description: Report an OpenShell vulnerability privately using the required advisory template. +body: + - type: markdown + attributes: + value: | + Follow [SECURITY.md](https://github.com/NVIDIA/OpenShell/blob/main/SECURITY.md) and the [advisory template](https://github.com/NVIDIA/OpenShell/blob/main/.agents/skills/create-security-advisory/assets/advisory-template.md). + + Review the report and verify its accuracy before submitting. Distinguish reproduced behavior, code inspection, and unverified claims. Remove secrets and personal information from evidence. + + - type: textarea + id: summary-and-impact + attributes: + label: Summary and impact + description: Describe what the attacker can do, which security boundary should prevent it, and the demonstrated impact. Separate unverified consequences. + placeholder: Summarize the vulnerability and its impact in two or three sentences. + validations: + required: true + + - type: textarea + id: scope-and-prerequisites + attributes: + label: Scope and prerequisites + description: Include each item below. Separate the tested revision from confirmed affected releases. For unknowns, state what needs checking. + placeholder: | + - Product and tested version: Component, release or full commit SHA; image digest if relevant. + - Affected versions: Confirmed release range and evidence, or Unknown with the needed check. + - Environment and configuration: Relevant OS, runtime/driver, topology, and exact settings; default or opt-in. + - Attacker access: Starting privileges, controlled input, and resources in scope. + validations: + required: true + + - type: textarea + id: reproduction-and-evidence + attributes: + label: Reproduction and evidence + description: Provide reproduction steps and observed results, or concrete code evidence of the attack path. State what was verified and what was not run; scanner output alone is insufficient. + placeholder: | + Verification status: Reproduced / code inspection only / reporter claim not reproduced. + + 1. Operator setup: Minimal prerequisites, test resources, and copyable commands/configuration. + 2. Attacker actions: Exact steps under the privileges stated above. + 3. Check: Read back the response or state change that demonstrates the impact. + + Expected: Security-preserving behavior; link the applicable policy, contract, or enforcing code. + Observed: Actual result and concise redacted output; if not executed, say so. + + Link the source report, private artifacts, and relevant code at an immutable revision. + State who verified what and any failed attempts or limitations. + validations: + required: true + + - type: textarea + id: additional-details + attributes: + label: Additional details + description: Include supported optional details that help review. Leave blank if none are available. + placeholder: | + Root cause, severity rationale and CVSS/CWE, existing CVE identifiers, + disclosure deadlines, a proposed fix or verified workaround, known + unaffected deployments, or a related private PR. + validations: + required: false + + - type: textarea + id: open-questions + attributes: + label: Open questions + description: List missing evidence that affects the assessment and the next check for each gap. Leave blank if there are no known gaps. + validations: + required: false diff --git a/SECURITY.md b/SECURITY.md index 8989f2c474..83116bb78d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,7 @@ Report OpenShell vulnerabilities through [GitHub's private reporting form](https://github.com/NVIDIA/OpenShell/security/advisories/new). Submitting a report does not publish an advisory. Do not disclose vulnerabilities in public issues, discussions, or pull requests. -Every report must use the [advisory template](.agents/skills/create-security-advisory/assets/advisory-template.md). Keep its core headings and include: +Every report must use the [advisory template](.agents/skills/create-security-advisory/assets/advisory-template.md). The [private reporting form](.github/VULNERABILITY_REPORT.yml) requires its three core sections. Keep its core headings and include: - Affected component and version, commit, or image digest. - Description, impact, and prerequisites for exploitation.