Skip to content

Commit 3e78e25

Browse files
dividordividor
committed
feat: add security issue template for vulnerability reporting
- Added comprehensive security.yml issue template - Includes severity levels, issue types, and impact assessment - Provides clear guidance on when to use private vs public reporting - Updated config.yml to include link to private security reporting - Supports responsible disclosure workflow with required acknowledgments
1 parent e952caa commit 3e78e25

2 files changed

Lines changed: 203 additions & 2 deletions

File tree

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
blank_issues_enabled: false
22
contact_links:
3+
- name: 🔒 Private Security Report
4+
url: https://github.com/Program-Integrity-Alliance/pia-mcp-local/security/advisories/new
5+
about: Report sensitive security vulnerabilities privately
36
- name: 💬 Discussions
4-
url: https://github.com/your-username/pia-mcp-local/discussions
7+
url: https://github.com/Program-Integrity-Alliance/pia-mcp-local/discussions
58
about: Ask questions and discuss ideas with the community
69
- name: 📚 Documentation
7-
url: https://github.com/your-username/pia-mcp-local/blob/main/README.md
10+
url: https://github.com/Program-Integrity-Alliance/pia-mcp-local/blob/main/README.md
811
about: Check out the project documentation

‎.github/ISSUE_TEMPLATE/security.yml‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
name: Security Issue
2+
description: Report a security vulnerability (please use private reporting for sensitive issues)
3+
title: "[Security]: "
4+
labels: ["security", "triage"]
5+
assignees: []
6+
body:
7+
- type: markdown
8+
attributes:
9+
value: |
10+
# Security Issue Report
11+
12+
**⚠️ IMPORTANT: For sensitive security vulnerabilities, please use GitHub's private vulnerability reporting feature instead of creating a public issue.**
13+
14+
You can report security vulnerabilities privately by going to the Security tab of this repository and clicking "Report a vulnerability".
15+
16+
Use this public template only for security-related issues that are not sensitive or have already been disclosed.
17+
18+
- type: input
19+
id: contact
20+
attributes:
21+
label: Contact Details
22+
description: How can we get in touch with you if we need more info?
23+
placeholder: ex. email@example.com
24+
validations:
25+
required: false
26+
27+
- type: dropdown
28+
id: severity
29+
attributes:
30+
label: Severity Level
31+
description: How severe do you consider this security issue?
32+
options:
33+
- Low
34+
- Medium
35+
- High
36+
- Critical
37+
validations:
38+
required: true
39+
40+
- type: dropdown
41+
id: issue-type
42+
attributes:
43+
label: Security Issue Type
44+
description: What type of security issue is this?
45+
options:
46+
- Authentication/Authorization
47+
- Data Exposure
48+
- Input Validation
49+
- Injection Attack
50+
- Cross-Site Scripting (XSS)
51+
- Cross-Site Request Forgery (CSRF)
52+
- Denial of Service (DoS)
53+
- Configuration Issue
54+
- Dependency Vulnerability
55+
- Other
56+
validations:
57+
required: true
58+
59+
- type: textarea
60+
id: description
61+
attributes:
62+
label: Security Issue Description
63+
description: Please provide a detailed description of the security issue.
64+
placeholder: |
65+
Describe the security vulnerability or concern...
66+
67+
Include:
68+
- What the issue is
69+
- Where it occurs
70+
- Why it's a security concern
71+
validations:
72+
required: true
73+
74+
- type: textarea
75+
id: steps-to-reproduce
76+
attributes:
77+
label: Steps to Reproduce
78+
description: How can this security issue be reproduced?
79+
placeholder: |
80+
1. Go to '...'
81+
2. Enter '...'
82+
3. Observe '...'
83+
4. See security issue
84+
validations:
85+
required: true
86+
87+
- type: textarea
88+
id: impact
89+
attributes:
90+
label: Potential Impact
91+
description: What could an attacker potentially do with this vulnerability?
92+
placeholder: |
93+
Describe the potential impact:
94+
- Data that could be accessed
95+
- Systems that could be compromised
96+
- Users that could be affected
97+
validations:
98+
required: true
99+
100+
- type: textarea
101+
id: affected-components
102+
attributes:
103+
label: Affected Components
104+
description: Which parts of the system are affected?
105+
placeholder: |
106+
- API endpoints
107+
- Authentication system
108+
- Database queries
109+
- File handling
110+
- etc.
111+
validations:
112+
required: false
113+
114+
- type: dropdown
115+
id: version
116+
attributes:
117+
label: Affected Version
118+
description: What version of the project is affected?
119+
options:
120+
- Latest (main branch)
121+
- 1.0.0
122+
- 0.9.0
123+
- Other (please specify in Additional Context)
124+
validations:
125+
required: true
126+
127+
- type: checkboxes
128+
id: environment
129+
attributes:
130+
label: Environment
131+
description: In what environment did you discover this issue?
132+
options:
133+
- label: Production
134+
required: false
135+
- label: Development
136+
required: false
137+
- label: Testing/Staging
138+
required: false
139+
- label: Docker
140+
required: false
141+
- label: Local Development
142+
required: false
143+
144+
- type: textarea
145+
id: mitigation
146+
attributes:
147+
label: Suggested Mitigation
148+
description: Do you have any suggestions for how to fix this issue?
149+
placeholder: |
150+
If you have ideas for how to address this security issue, please share them here.
151+
This is optional but helpful.
152+
validations:
153+
required: false
154+
155+
- type: textarea
156+
id: logs
157+
attributes:
158+
label: Relevant Logs/Evidence
159+
description: Please provide any relevant logs, screenshots, or other evidence (redact sensitive information).
160+
render: shell
161+
validations:
162+
required: false
163+
164+
- type: checkboxes
165+
id: disclosure
166+
attributes:
167+
label: Responsible Disclosure
168+
description: Please confirm your commitment to responsible disclosure
169+
options:
170+
- label: I understand this is a public issue and will not include sensitive details that could be exploited
171+
required: true
172+
- label: I have not disclosed this vulnerability publicly elsewhere
173+
required: false
174+
- label: I am willing to work with the maintainers to resolve this issue
175+
required: true
176+
177+
- type: checkboxes
178+
id: terms
179+
attributes:
180+
label: Code of Conduct
181+
description: By submitting this issue, you agree to follow our Code of Conduct
182+
options:
183+
- label: I agree to follow this project's Code of Conduct
184+
required: true
185+
186+
- type: textarea
187+
id: additional-context
188+
attributes:
189+
label: Additional Context
190+
description: Add any other context about the security issue here.
191+
placeholder: |
192+
Any additional information that might be helpful:
193+
- Related security research
194+
- Similar issues in other projects
195+
- Timeline constraints
196+
- etc.
197+
validations:
198+
required: false

0 commit comments

Comments
 (0)