From 7c14dd274afcf354775f3eac9c89001661588f82 Mon Sep 17 00:00:00 2001 From: Iko Date: Sun, 9 Aug 2026 20:01:39 +0700 Subject: [PATCH] docs(builder): add proper SECURITY.md with project contact info GitHub auto-generates a default security policy page, but there was no SECURITY.md in the repo. Create one with the project-specific email (iap@disroot.org) and GPG key for vulnerability reporting, rather than the generic GitPod redirect that GitHub defaults to. --- SECURITY.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..702b8f5 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,34 @@ +# Security Policy + +## Reporting a Vulnerability + +Security is a top priority for the Hermes builder plugin. If you believe you have found a security vulnerability, please report it to us. + +### How to Report + +- **Email**: `iap@users.noreply.github.com` (GPG: `0049 2CBB E90A F475 521F 68B9 9166 D30F 6FE7 0F56`) +- **GitHub Security Advisories**: Use the "Report a vulnerability" button on the [Security tab](https://github.com/iap/builder/security/policy) + +### What to Include + +Please include the following in your report: + +1. A description of the vulnerability and its impact +2. Steps to reproduce the issue +3. Any proof-of-concept code or exploit +4. Your contact information and availability + +### Response Timeline + +- We will acknowledge your report within 48 hours +- We will provide a more detailed response within 7 days +- We will keep you informed of the progress towards a fix +- If the vulnerability is confirmed, we will coordinate a disclosure timeline + +### Scope + +This policy covers all repositories under the `iap/builder` GitHub organization. Please note that this plugin is a guest in the Hermes ecosystem — core Hermes security issues should be reported to [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent) instead. + +### Preferred Languages + +We prefer reports in English.