docs: add secirity policy and reporting guidelines#567
Conversation
|
CodeAnt AI is reviewing your PR. |
|
@manikanta-tamminana is attempting to deploy a commit to the Karan Mani Tripathi 's projects Team on Vercel. A member of the Team first needs to authorize it. |
WalkthroughThis PR establishes a security vulnerability reporting process by adding a ChangesSecurity Policy Addition
🎯 1 (Trivial) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
There was a problem hiding this comment.
Technical Review
Hi @manikanta-tamminana! Thank you for your contribution to DoubtDesk.
The code changes look good. Before we can complete the technical review, approve, and merge this pull request, we have one final requirement for all contributors: Please star the DoubtDesk repository.
Once you have starred the repository, please drop a comment here saying "done" (or we will automatically detect it) and we will proceed with approving and merging your PR. Thank you.
|
@coderabbitai review |
There was a problem hiding this comment.
Hello there! 🎉 Thank you so much for your first pull request to DoubtDesk!
We really appreciate your contribution. A maintainer will review your code soon. If you are participating in GSSoC, ensure your PR is linked to an open issue. Please make sure you have followed all rules in our Contributing Guidelines. Happy coding!
There was a problem hiding this comment.
Hello there! 🎉 Thank you so much for your first pull request to DoubtDesk!
We really appreciate your contribution. A maintainer will review your code soon. If you are participating in GSSoC, ensure your PR is linked to an open issue. Please make sure you have followed all rules in our Contributing Guidelines. Happy coding!
codeant-ai
Bot
added
the
size:M
github-actions
Bot
removed
the
size:M
|
CodeAnt AI finished reviewing your PR. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SECURITY.md`:
- Around line 18-19: Update the ambiguous sentence "Instead, report the issue
privately to the project maintainers through GitHub or any official
communication channel provided by the maintainers." to name concrete private
reporting channels and make one primary: specify a monitored security email
(e.g., security@<your-domain>.com) and the GitHub Security Advisories URL
(https://github.com/OWNER/REPO/security/advisories) as the preferred paths,
instruct reporters to use those private channels first, and remove/replace the
generic "official communication channel" wording in SECURITY.md.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: cad54202-ebbd-48df-bc8a-649fa4425d82
📒 Files selected for processing (3)
CONTRIBUTING.mdREADME.mdSECURITY.md
| Instead, report the issue privately to the project maintainers through GitHub or any official communication channel provided by the maintainers. | ||
|
|
There was a problem hiding this comment.
Define an explicit private reporting channel (not a generic “official channel”).
The current wording is ambiguous and can still route reports to public/non-triaged paths. Please name at least one concrete private path (e.g., security email and/or GitHub Security Advisories link) and make it the primary instruction.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 18 - 19, Update the ambiguous sentence "Instead,
report the issue privately to the project maintainers through GitHub or any
official communication channel provided by the maintainers." to name concrete
private reporting channels and make one primary: specify a monitored security
email (e.g., security@<your-domain>.com) and the GitHub Security Advisories URL
(https://github.com/OWNER/REPO/security/advisories) as the preferred paths,
instruct reporters to use those private channels first, and remove/replace the
generic "official communication channel" wording in SECURITY.md.
|
Hi @knoxiboy, I have already starred the repository. The check_star workflow still seems to be failing. Could you please re-run or approve the pending workflows? Thank you. |
github-actions
Bot
added
gssoc:approved
2 participants
User description
Description
Adds a security policy and vulnerability reporting guidelines for DoubtDesk.
Changes Made
SECURITY.mdREADME.mdCONTRIBUTING.mdRelated Issue
Closes #531
Type of Change
Screenshots
Not applicable.
How Has This Been Tested?
CodeAnt-AI Description
Add security reporting guidance and responsible disclosure instructions
What Changed
Impact
✅ Clearer vulnerability reporting✅ Fewer public security disclosures✅ Faster security triage💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit