From bb2973914123d03de48cd3f129123e9b4ae9f066 Mon Sep 17 00:00:00 2001 From: Derek Corniello Date: Fri, 17 Jul 2026 12:54:30 -0700 Subject: [PATCH 1/2] docs: add an org-wide security policy The org .github repo had a code of conduct and contributing guide but no security policy, so no repo advertised how to report a vulnerability. Adds SECURITY.md directing reporters to GitHub private vulnerability reporting (supported on these repos) with a private maintainer fallback, and notes the alpha support window and the untrusted-code scope (playground sandbox, compiler/runtime memory safety, shipped deps). Claude-Session: https://claude.ai/code/session_01NN6tAVpzkn8ZwE7M3hfyQk --- SECURITY.md | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..a0097f8 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,52 @@ +# Security Policy + +This policy applies to all repositories in the [muxlang](https://github.com/muxlang) +organization (the compiler, runtime, website, playground API, and tooling). + +## Supported versions + +Mux is in **alpha** and moves fast. Security fixes land on `main` and ship in the +next release; only the latest release of each repository is supported. There are +no long-term-support branches. The compiler version reported by `mux --version` +is the canonical "Mux version". + +## Reporting a vulnerability + +**Please do not open a public issue for a security problem, and do not post +details in discussions or pull requests.** + +Report privately through GitHub's private vulnerability reporting: + +1. Go to the affected repository's **Security** tab. +2. Click **Report a vulnerability** (under "Advisories"). +3. Describe the issue with enough detail to reproduce it. + +This opens a private advisory visible only to you and the maintainers. If you +cannot use private reporting, contact the maintainer +[@DerekCorniello](https://github.com/DerekCorniello) directly and privately. + +Please include, where you can: + +- the repository and version or commit affected, +- a description of the vulnerability and its impact, +- steps or a minimal case to reproduce it, +- any relevant logs, `.mux` input, or generated IR. + +## What to expect + +- We aim to acknowledge a report within a few days. +- We will confirm the issue, keep you updated on progress, and credit you in the + advisory and release notes unless you ask us not to. +- Once a fix is released, we publish the advisory with the details. + +## Scope + +The Mux toolchain compiles and runs untrusted code by design (notably the +playground API, which executes user-submitted programs in a sandbox). Reports +that are especially valuable include: + +- sandbox escapes or resource-exhaustion bypasses in the playground API, +- compiler or runtime memory-safety issues reachable from valid Mux input, +- vulnerable dependencies with a practical exploit path in a shipped artifact. + +Thank you for helping keep Mux and its users safe. From c5a19b3c97882bdf0f564fced75ae9eb423fa281 Mon Sep 17 00:00:00 2001 From: Derek Corniello Date: Fri, 17 Jul 2026 14:28:43 -0700 Subject: [PATCH 2/2] docs: add a disclosure timeline and clarify the reporting channel Address review: state a 90-day coordinated-disclosure target with a coordinate-before-public-disclosure request, and note that private vulnerability reporting reaches the whole maintainer team (the primary channel), so a report never depends on one person - the named maintainer is only the fallback. Claude-Session: https://claude.ai/code/session_01NN6tAVpzkn8ZwE7M3hfyQk --- SECURITY.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index a0097f8..155cd53 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -21,9 +21,11 @@ Report privately through GitHub's private vulnerability reporting: 2. Click **Report a vulnerability** (under "Advisories"). 3. Describe the issue with enough detail to reproduce it. -This opens a private advisory visible only to you and the maintainers. If you -cannot use private reporting, contact the maintainer -[@DerekCorniello](https://github.com/DerekCorniello) directly and privately. +This opens a private advisory visible only to you and the repository's +maintainer team (the primary channel, so a report does not depend on any single +person being available). If you cannot use private reporting, contact a +maintainer - currently [@DerekCorniello](https://github.com/DerekCorniello) - +directly and privately. Please include, where you can: @@ -37,7 +39,10 @@ Please include, where you can: - We aim to acknowledge a report within a few days. - We will confirm the issue, keep you updated on progress, and credit you in the advisory and release notes unless you ask us not to. -- Once a fix is released, we publish the advisory with the details. +- We aim to release a fix and publish the advisory within **90 days** of + acknowledgment. If we need longer, we will say so and agree a timeline with + you; if you plan to disclose publicly, please coordinate with us first so a + fix is available to users. ## Scope