Vulnerability Disclosure Process

Reporting

Security vulnerabilities should be reported via GitHub's private vulnerability reporting feature. Navigate to the repository Security tab and select "Report a vulnerability."

Do not open a public issue for security vulnerabilities.

Response SLAs

Severity	Acknowledge	Triage	Fix
Critical	24 hours	48 hours	7 days
High	48 hours	5 days	14 days
Medium	5 days	10 days	30 days
Low	10 days	30 days	Next release

Triage Process

1. Acknowledge receipt to the reporter
2. Reproduce the vulnerability
3. Assess severity using CVSS or equivalent
4. Determine affected components and blast radius
5. Create a private fix branch
6. Test the fix
7. Merge and release
8. Notify the reporter
9. Publish advisory if applicable

Scope

This process covers:

• The repository code and configuration
• GitHub Actions workflows
• Dependencies (npm and Python)
• The deployed site (chrisnewcomb.name)
• Cloudflare configuration

Coordination

For vulnerabilities in upstream dependencies (Docusaurus, npm packages), the process is:

1. Check if a patch exists upstream
2. If yes, update the dependency
3. If no, document as accepted risk in SECURITY.md with mitigation details
4. Monitor upstream for a fix

SECURITY.md

The root-level SECURITY.md file provides the public-facing reporting instructions and must stay in sync with this document. Updates to the disclosure process should be reflected in both locations.

Related Content

• Network Egress Audit
• Secret Rotation Schedule
• Signed Commits Policy
• ADR Template
• Content Contract