Skip to content

Add repo-specific SECURITY.md replacing the generic template#54

Merged
chefgs merged 2 commits intomainfrom
copilot/add-security-rule-file
Mar 21, 2026
Merged

Add repo-specific SECURITY.md replacing the generic template#54
chefgs merged 2 commits intomainfrom
copilot/add-security-rule-file

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 21, 2026

The standard GitHub SECURITY.md template assumes a web service / data-processing app threat model, which doesn't fit a config-generation CLI and local MCP server.

Changes

  • New SECURITY.md scoped to DevOps-OS's actual threat surface:
    • In scope: insecure defaults in generated configs (K8s, ArgoCD, pipelines), CLI argument injection into generated YAML, MCP server path-traversal / unauthenticated remote code paths, dependency CVEs, CI supply-chain integrity
    • Out of scope: security of infrastructure users deploy from generated configs, upstream CVEs in tools DevOps-OS generates config for (ArgoCD, Flux, etc.)
    • Supported versions policy (latest only)
    • Private disclosure process via email (consistent with CODE_OF_CONDUCT.md contact)
    • User-facing best practices tailored to consumers of generated DevOps configs (review before deploy, restrict ArgoCD source repos, MCP server localhost-only)

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

Copilot AI changed the title [WIP] Add security rule file based on repository nature Add repo-specific SECURITY.md replacing the generic template Mar 21, 2026
Copilot AI requested a review from chefgs March 21, 2026 16:00
@chefgs chefgs marked this pull request as ready for review March 21, 2026 16:07
@chefgs chefgs merged commit 6a7d344 into main Mar 21, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants