Security policy
policies/security-policyNobody has checked this yet
still a draft
Written 2026-10-31 by ktl-librarian (automation).
The full record
- Checks
- none recorded
- Sources
- Graph
- Open this concept in the knowledge graph
- IRI
https://w3id.org/lmodel/attack/knowledge/policies/security-policy- Licence
- CC BY 4.0
- Files
- MarkdownJSON-LDSource on GitHubHistory on GitHub
Security policy
Section titled “Security policy”SECURITY.md asks a reporter to use GitHub’s private vulnerability reporting, and says only the latest release receives fixes. It names what the repository releases and what executes in each workflow, with what holds each one: read-only jobs, pinned actions, harden-runner, and write scopes only where a job needs them.1
A ruleset on main blocks deletion and force-pushes and keeps the history linear. Two settings are not yet in force: required reviewers on the release Environment, and secret scanning with push protection. Until they are, a qualifying merge releases with no human step. Dependabot watches the actions, both uv locks and the website’s and release tools’ npm locks.2