0 Fork 0

Files

T

docs: add adoption guide, security policy and code owners

Add an "Adopting in another app" section to the README (version,
.munitor.yml example, CircleCI settings, contexts and secrets, branch
model, deployment infrastructure, known limitations, 0.3.3 upgrade
notes), a tier and standards statement, and reference rows for the
previously undocumented .munitor.yml keys. Add SECURITY.md,
.github/CODEOWNERS and a CONTRIBUTING workflow section (branches,
Conventional Commits, DCO sign-off, local checks), and fix the
nonexistent `make test` target in CLAUDE.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

2026-10-12 05:29:05 -05:00

2.2 KiB

Raw Permalink Blame History

Security Policy

Reporting a vulnerability

Do not open a public issue for a security problem.

Report it privately through GitHub's private vulnerability reporting (the repository's Security tab, then Report a vulnerability). If that form is unavailable, contact the maintainer privately through GitHub before disclosing anything.

Security contact: James Maes (@KofTwentyTwo), maintainer.

Please include the affected orb version, the .munitor.yml pipeline type, how to reproduce it, and the impact you see. Never include secrets or CircleCI context values.

What to expect

KofTwentyTwo follows coordinated vulnerability disclosure. Timeframes are counted from the day the report arrives and come from the KofTwentyTwo security program:

Step	Target
Acknowledge the report	7 days
Assess it: confirm or reject, with a severity	14 days
Release a fix for a CRITICAL vulnerability	7 days
Release a fix for a HIGH vulnerability	30 days
Release a fix for a MEDIUM vulnerability	90 days
Release a fix for a LOW vulnerability	The next release
Publish the advisory (GitHub Security Advisory, CVE where applicable)	When the fix ships, or 90 days after the report, whichever comes first

Reporters are credited in the advisory unless they ask not to be.

Supported versions

Version	Security fixes
0.3.x (`kof22/munitor@0.3`)	Yes
Older	No; upgrade to the latest release

Only the latest minor line receives fixes; a line ends when the next minor version is published to the CircleCI orb registry.

Scope notes

Munitor runs inside the consumer's CircleCI project with the consumer's contexts (registry, GitHub, SonarCloud, NVD). Issues that let a generated pipeline leak context secrets, push an image or GitOps change for the wrong commit, or bypass a security gate are in scope.

Published vulnerabilities

Fixed vulnerabilities are published as GitHub Security Advisories.

2.2 KiB Raw Permalink Blame History