From 5ebb9620f5d0f9178e6011a9406f2850ea644f3e Mon Sep 17 00:00:00 2001 From: AsafGolombek Date: Tue, 28 Jul 2026 19:37:17 +0300 Subject: [PATCH] docs(security): align org-default policy with the real disclosure process This file is the Security-tab default for org repos that do not ship their own SECURITY.md (homebrew-tap, scoop-bucket, linux-repo, awesome-nimbus, nimbus-benchmarks, plus private repos). It already led with private vulnerability reporting, and its pointer to nimbus-security still resolves after that repo's rewrite. Two fixes: - "We aim to acknowledge reports within a few business days" contradicted the rewritten policy, which states plainly that a solo maintainer cannot guarantee a response time. Replaced with the same honest expectation so a reporter sees one answer wherever they land. - The alternative "or follow the disclosure instructions in nimbus-security" read as a second, separate channel. nimbus-security now routes back to PVR, so it is described as the full policy text rather than another way to report. Also adds a direct advisories/new link for reporters who cannot tell which repository is affected, and states there is no bug bounty. Co-Authored-By: Claude Opus 5 (1M context) --- SECURITY.md | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 8c17a61..4d08e25 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,11 +10,21 @@ live in one place: Please do **not** open a public issue for security reports. -Instead, use GitHub's private vulnerability reporting on the affected repository -(the **Security** tab → **Report a vulnerability**), or follow the disclosure -instructions in the [nimbus-security](https://github.com/nimbus-agent/nimbus-security) -repository. - -We aim to acknowledge reports within a few business days and will coordinate a -fix and a disclosure timeline with you. Thank you for helping keep Nimbus and -its users safe. +Use GitHub's private vulnerability reporting on the affected repository: its +**Security** tab → **Report a vulnerability**. This is the only reporting +channel — Nimbus publishes no security email address and no PGP key, because a +solo maintainer's unmonitored inbox drops reports silently. Filing requires a +free GitHub account. + +If you are not sure which repository is affected, report it against +[Nimbus](https://github.com/nimbus-agent/Nimbus/security/advisories/new) and we +will move it. + +Nimbus is maintained by one person as a side project, so there is no guaranteed +response time and no SLA. Reports are typically read within a week and +prioritised by severity, and we will agree a coordinated-disclosure timeline +with you rather than sitting on a report. There is no bug-bounty programme. + +Full policy, scope and safe-harbor terms: +[nimbus-security/SECURITY.md](https://github.com/nimbus-agent/nimbus-security/blob/main/SECURITY.md). +Thank you for helping keep Nimbus and its users safe.