Create SECURITY.md with policy details#1
Conversation
Add a security policy document outlining supported versions and vulnerability reporting.
Summary of ChangesHello @jz197781, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a foundational Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a SECURITY.md file, which is an important step for the project's security posture. However, the file currently contains placeholder content from a template. My review focuses on the need to replace this placeholder text with the project's actual security policy. Specifically, the 'Supported Versions' section needs to be clarified, and the 'Reporting a Vulnerability' section requires concrete instructions for reporters. Addressing these points is critical to ensure the security policy is clear and actionable.
| Use this section to tell people how to report a vulnerability. | ||
|
|
||
| Tell them where to go, how often they can expect to get an update on a | ||
| reported vulnerability, what to expect if the vulnerability is accepted or | ||
| declined, etc. |
There was a problem hiding this comment.
The 'Reporting a Vulnerability' section contains only placeholder text. It is critical to provide clear, actionable instructions for anyone who finds a security vulnerability. Please replace this placeholder with specific details, including the exact reporting channel (e.g., a dedicated email address or GitHub's private vulnerability reporting feature) and what reporters can expect regarding response times and the handling process.
| Use this section to tell people how to report a vulnerability. | |
| Tell them where to go, how often they can expect to get an update on a | |
| reported vulnerability, what to expect if the vulnerability is accepted or | |
| declined, etc. | |
| To report a security vulnerability, please use the **Private Vulnerability Reporting** feature on GitHub. | |
| You can expect a response from our team within 48 hours of submission. If the vulnerability is accepted, we will work on a fix and disclose it publicly after the patch is released. |
| Use this section to tell people about which versions of your project are | ||
| currently being supported with security updates. | ||
|
|
||
| | Version | Supported | | ||
| | ------- | ------------------ | | ||
| | 5.1.x | :white_check_mark: | | ||
| | 5.0.x | :x: | | ||
| | 4.0.x | :white_check_mark: | | ||
| | < 4.0 | :x: | |
There was a problem hiding this comment.
The content in the 'Supported Versions' section appears to be the default template text and presents a confusing support schedule (e.g., version 5.0.x is unsupported while the older 4.0.x is supported). Please replace this placeholder with the project's actual version support policy. For clarity, it's best to list versions in descending order and accurately state their support status.
1 participant
Add a security policy document outlining supported versions and vulnerability reporting.