Decide the source-available trigger — repo is still private under ELv2 #219

Activity

1. NathanTarbert

   added

   roadmapTracked on the Outpost roadmapTracked on the Outpost roadmap

   roadmap: laterRoadmap horizon: backlog / cleanupRoadmap horizon: backlog / cleanup

   area: docsDocs, README, .env accuracyDocs, README, .env accuracy

   on Aug 17, 2026
2. jpr5 commented on Sep 15, 2026

   

   jpr5

   on Sep 15, 2026

   Contributor

   More actions

   Closing this as stale: the decision it was asking for has been made by events. The repo went public on 2026-09-14, so "is source-available still the intent?" and "what is the trigger?" no longer have anything to decide — it happened.

   What does not go away is the prerequisite list in this issue. Those items were prerequisites for going public, and they are still outstanding now that we are public — which makes them more urgent, not less. Carrying each one forward to a real tracked issue rather than leaving it buried in a closed one:

   Prerequisite from this issue	Now tracked as
   No secrets in git history	#278 — Git history has never been scanned for secrets, and it is now public
   A security policy for reporting vulnerabilities	#277 — No SECURITY.md — the repo is public with no vulnerability disclosure channel
   README accurate	#119 — README architecture/structure is out of date
   .env.example accurate	#155 and #156
   A contributing guide	not filed — see note below

   Newly filed:

   • Git history has never been scanned for secrets, and it is now public #278 — full-history secret scan (gitleaks + trufflehog over all refs) and rotation of anything found. Worth being explicit about why this is separate from the issue redaction work we already did: that cleaned GitHub's issue store, and did nothing to the git object tree, which is a different store and is now public. And the remediation there is rotation, not deletion — a history rewrite does not reach forks, existing clones, or the scrapes that happen within minutes of a repo going public.
   • No SECURITY.md — the repo is public with no vulnerability disclosure channel #277 — SECURITY.md does not exist at the root, in .github/, or in docs/, and GitHub's community profile confirms no security policy. An external reporter who finds a vulnerability in now-public code has no private channel to use.

   Not carried forward: this issue also listed a contributing guide as a prerequisite. community/profile confirms there is still no CONTRIBUTING.md. That one is deliberately left unfiled here rather than filed silently — it needs a call on whether we actually want external contributions to Outpost before it is worth writing.
3. jpr5

   closed this as completedon Sep 15, 2026