[2-week comment period thru 26/08/07] 1.0 CONTRIBUTING.md changes: PR/Issue Scope, SECURITY.md, Licensing - #1757
Conversation
GitHub surfaces this file in the Security tab and in the report-a- vulnerability flow, so private disclosure has a discoverable path instead of landing in the public issue tracker.
GitHub requests review from listed owners on every PR, and the file makes the maintainer set public and machine-readable. Enforcement via the require-review-from-code-owners branch protection setting is a separate decision.
Write down the norms a contributor needs while working in this repository.
Coverage Report for CI Build 29996669924Coverage remained the same at 86.374%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
|
Maybe worth taking this out of draft status? Draft PRs don't necessarily get looked at (I know that I tend to skip them). |
There was a problem hiding this comment.
Concept ACK
One suggestion on SECURITY.md: it currently lists only an email address for vulnerability reports. Since reports travel through several SMTP hops before reaching a maintainer, projects handling financial software often pair the contact email with a PGP public key or a link to one on a so reporters can encrypt sensitive details in transit.
Worth considering adding a fingerprint or key link alongside the email.
|
Should we just direct anyone to https://github.com/payjoin/rust-payjoin/tree/master/contrib/release/keys that wants to encrypt their message so we don't have to worry about managing public keys spread all over the repo? |
I was thinking of the same solution as well. The important thing is to make the public keys easily accessible |
5 participants
As we prepare for rust-payjoin 1.0 maturity and release, I'd like to make some operational policy explicit in CONTRIBUTING.md. Opening the change a 2-week community comment period.
I commit to responding to any substantial comments during the comment period.
Pull Request Checklist
Please confirm the following before requesting review:
AI
in the body of this PR.