docs: add SECURITY.md (first public security policy)#19
Merged
Conversation
…hain policy) First-of-its-kind public security policy for the quantcli org. Covers: - Private vulnerability reporting via GitHub private advisories and security@quantcli.org, with a 5-business-day acknowledgement SLA and 90-day default disclosure window. - Supported-branch policy (latest minor on main of each CLI). - Supply-chain CI gate (govulncheck + osv-scanner + license allowlist) matching what landed in #5. - What's intentionally not in scope yet (signed releases, SBOMs, full threat model, pen test). Text approved by board under approval 6493bc0c-54dd-470f-9644-1480c267221e on 2026-05-10. Resolves the dead anchor that landed temporarily in #5 (CONTRIBUTING.md and security.yml error messages both reference SECURITY.md) — Lead Go review accepted the one-cycle gap; this PR closes it. Co-Authored-By: Paperclip <noreply@paperclip.ing>
DTTerastar
approved these changes
May 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First-of-its-kind public security policy for the
quantcliorg. The text was approved by the board under approval6493bc0con 2026-05-10.What's in it
security@quantcli.org(PGP key forthcoming).main; older releases not patched.govulncheck+osv-scanner+ license allowlist), with the explicit SPDX allow/denylist.Why now
The CI gate that landed in #5 references
SECURITY.mdfrom CONTRIBUTING.md and from a license-policy failure message. Lead Go's review on #5 accepted that one-cycle gap on condition thatSECURITY.mdships next. This is that next PR.Source
Text matches the body of approval
6493bc0c-54dd-470f-9644-1480c267221e(full text in the approval payload) — no drift between what the board approved and what's being merged.Test plan
(SECURITY.md)resolves once this lands on main..github/workflows/security.ymlerror messages now point at a real file.SECURITY.md(CommunityManager can plumb those later if useful).Tracks: QUA-7 (acceptance criterion: SECURITY.md merged after CEO confirmation).