docs: Update SECURITY.md #640
Conversation
Fixes #597 Signed-off-by: Jann Fischer <jann@mistrust.net>
WalkthroughReplaces SECURITY.md with a formal Policy header and Preface; defines that only the latest minor release will receive security fixes (no backports); and specifies a responsible disclosure process using confidential GitHub security issues, triage/coordination, and publication via GitHub Security Advisories with CVE issuance and optional reporter credit/anonymity. Changes
Sequence Diagram(s)sequenceDiagram
participant Reporter as Reporter
participant Repo as Repository Security
participant Maintainer as Maintainers
participant Advisory as GitHub Security Advisory / CVE
Reporter->>Repo: Submit confidential security issue
Note right of Repo `#DDEBF7`: Triage & acknowledge (public/private timeline)
Repo->>Maintainer: Share vulnerability details privately
Maintainer->>Repo: Propose fix & disclosure timeline
alt Fix accepted
Maintainer->>Advisory: Publish advisory & request CVE
Advisory->>Reporter: Provide advisory link & credit/anonymity option
else More info / coordination
Maintainer->>Reporter: Request details / coordinate timeline
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (4 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🧰 Additional context used🧠 Learnings (1)📚 Learning: 2025-10-31T10:37:27.987ZApplied to files:
🪛 LanguageToolSECURITY.md[style] ~11-~11: This is not the usual sequence for adjectives that have no special emphasis. (EN_ADJ_ORDER) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (4)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
SECURITY.md (3)
11-11: Simplify wording in Supported Versions.The phrase "for the time being" is flagged as wordy and could be replaced with a more direct term such as "currently." Additionally, the hyphenated term "back-ports" is non-standard; the industry-standard term is "backports" (single word).
-Only the most recent minor release (e.g. 1.0 or 1.1) will receive security fixes for the time being, and no back-ports will be made. +Only the most recent minor release (e.g. 1.0 or 1.1) will receive security fixes currently, and no backports will be made.
17-17: Use descriptive link text.The link text "here" is not descriptive. Consider using a more explicit phrase that clearly indicates what will happen when clicked.
-Please report vulnerabilities confidentially using GitHub's private security issue feature. You can create such a confidential vulnerability report [here](https://github.com/argoproj-labs/argocd-agent/security/advisories/new). +Please report vulnerabilities confidentially using GitHub's private security issue feature. You can [create a confidential security advisory](https://github.com/argoproj-labs/argocd-agent/security/advisories/new).
19-19: Hyphenate compound adjectives."Out of office" should be hyphenated as "out-of-office" when used as a compound adjective before a noun.
-We will do our best to react quickly on your inquiry, and to coordinate a fix and disclosure with you. Sometimes, it might take a little longer for us to react (e.g. out of office conditions), so please bear with us in these cases. +We will do our best to react quickly on your inquiry, and to coordinate a fix and disclosure with you. Sometimes, it might take a little longer for us to react (e.g. out-of-office conditions), so please bear with us in these cases.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
SECURITY.md(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-10-31T10:37:27.987Z
Learnt from: chetan-rns
Repo: argoproj-labs/argocd-agent PR: 632
File: test/data/pre-sync/pre-sync-job.yaml:2-17
Timestamp: 2025-10-31T10:37:27.987Z
Learning: In the argocd-agent repository, Kubernetes manifests under test/data/ directories are test fixtures for e2e testing and do not require production-grade security hardening such as securityContext settings for runAsNonRoot or allowPrivilegeEscalation.
Applied to files:
SECURITY.md
🪛 LanguageTool
SECURITY.md
[style] ~11-~11: This is not the usual sequence for adjectives that have no special emphasis.
Context: .... ## Supported Versions Only the most recent minor release (e.g. 1.0 or 1.1) will receive ...
(EN_ADJ_ORDER)
[style] ~11-~11: This phrasing can be wordy. For improved clarity, try opting for something more concise.
Context: ...1.0 or 1.1) will receive security fixes for the time being, and no back-ports will be made. ## Re...
(FOR_THE_TIME_BEING)
[grammar] ~19-~19: Use a hyphen to join words.
Context: ... little longer for us to react (e.g. out of office conditions), so please bear wi...
(QB_NEW_EN_HYPHEN)
[grammar] ~19-~19: Use a hyphen to join words.
Context: ...ttle longer for us to react (e.g. out of office conditions), so please bear with ...
(QB_NEW_EN_HYPHEN)
🪛 markdownlint-cli2 (0.18.1)
SECURITY.md
17-17: Link text should be descriptive
(MD059, descriptive-link-text)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build and push image
- GitHub Check: Analyze (go)
🔇 Additional comments (1)
SECURITY.md (1)
1-23: Security policy substantively addresses the requirements.The updated SECURITY.md successfully establishes the formal security vulnerability disclosure process and commitment to CVE issuance that were requested in issue #597. The policy clearly outlines:
- Confidential reporting mechanism via GitHub security advisories
- Commitment to publish advisories with CVE issuance
- Versioning constraints for security fixes (only latest minor release)
- Explicit guidance to prevent duplicate reports
This policy enables organizations to adopt the project with confidence in the security support model.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jann Fischer <jann@mistrust.net>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
SECURITY.md (2)
17-17: Use descriptive link text instead of generic "here".The link text "here" is not descriptive for accessibility and clarity. Provide context about what the link does.
-Please report vulnerabilities confidentially using GitHub's private security issue feature. You can create such a confidential vulnerability report [here](https://github.com/argoproj-labs/argocd-agent/security/advisories/new). +Please report vulnerabilities confidentially using GitHub's private security issue feature. You can [create a confidential vulnerability report](https://github.com/argoproj-labs/argocd-agent/security/advisories/new).
19-19: Hyphenate compound adjective "out-of-office".Compound adjectives should be hyphenated when they precede a noun.
-We will do our best to react quickly on your inquiry, and to coordinate a fix and disclosure with you. Sometimes, it might take a little longer for us to react (e.g. out of office conditions), so please bear with us in these cases. +We will do our best to react quickly on your inquiry, and to coordinate a fix and disclosure with you. Sometimes, it might take a little longer for us to react (e.g. out-of-office conditions), so please bear with us in these cases.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
SECURITY.md(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-10-31T10:37:27.987Z
Learnt from: chetan-rns
Repo: argoproj-labs/argocd-agent PR: 632
File: test/data/pre-sync/pre-sync-job.yaml:2-17
Timestamp: 2025-10-31T10:37:27.987Z
Learning: In the argocd-agent repository, Kubernetes manifests under test/data/ directories are test fixtures for e2e testing and do not require production-grade security hardening such as securityContext settings for runAsNonRoot or allowPrivilegeEscalation.
Applied to files:
SECURITY.md
🪛 LanguageTool
SECURITY.md
[style] ~11-~11: This is not the usual sequence for adjectives that have no special emphasis.
Context: .... ## Supported Versions Only the most recent minor release (e.g. 1.0 or 1.1) will receive ...
(EN_ADJ_ORDER)
[style] ~11-~11: This phrasing can be wordy. For improved clarity, try opting for something more concise.
Context: ...1.0 or 1.1) will receive security fixes for the time being, and no back-ports will be made. ## Re...
(FOR_THE_TIME_BEING)
[grammar] ~19-~19: Use a hyphen to join words.
Context: ... little longer for us to react (e.g. out of office conditions), so please bear wi...
(QB_NEW_EN_HYPHEN)
[grammar] ~19-~19: Use a hyphen to join words.
Context: ...ttle longer for us to react (e.g. out of office conditions), so please bear with ...
(QB_NEW_EN_HYPHEN)
🪛 markdownlint-cli2 (0.18.1)
SECURITY.md
17-17: Link text should be descriptive
(MD059, descriptive-link-text)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build and push image
- GitHub Check: Analyze (go)
🔇 Additional comments (1)
SECURITY.md (1)
1-23: Policy addresses PR objectives well; addresses blocking issues from #597.The restructured security policy establishes a responsible vulnerability disclosure process, commits to CVE issuance via GitHub Security Advisories, and provides clear guidance for reporters. This directly resolves the organizational adoption concerns raised in issue #597.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jann Fischer <jann@mistrust.net>
|
@coderabbitai help |
ChatThere are 3 ways to chat with CodeRabbit:
CodeRabbit commands
Other keywords and placeholders
CodeRabbit configuration file (
|
@coderabbitai Create commitable suggestions for your nit comments |
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
SECURITY.md (1)
11-11: Minor: Consider simplifying "for the time being."The phrase "for the time being" is somewhat redundant in a policy statement. Consider replacing it with more direct phrasing such as "Currently, only the most recent minor release will receive security fixes, and no back-ports will be made." or simply removing the qualifier entirely.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
SECURITY.md(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-10-31T10:37:27.987Z
Learnt from: chetan-rns
Repo: argoproj-labs/argocd-agent PR: 632
File: test/data/pre-sync/pre-sync-job.yaml:2-17
Timestamp: 2025-10-31T10:37:27.987Z
Learning: In the argocd-agent repository, Kubernetes manifests under test/data/ directories are test fixtures for e2e testing and do not require production-grade security hardening such as securityContext settings for runAsNonRoot or allowPrivilegeEscalation.
Applied to files:
SECURITY.md
🪛 LanguageTool
SECURITY.md
[style] ~11-~11: This is not the usual sequence for adjectives that have no special emphasis.
Context: .... ## Supported Versions Only the most recent minor release (e.g. 1.0 or 1.1) will receive ...
(EN_ADJ_ORDER)
[style] ~11-~11: This phrasing can be wordy. For improved clarity, try opting for something more concise.
Context: ...1.0 or 1.1) will receive security fixes for the time being, and no back-ports will be made. ## Re...
(FOR_THE_TIME_BEING)
[grammar] ~19-~19: Use a hyphen to join words.
Context: ... little longer for us to react (e.g. out of office conditions), so please bear wi...
(QB_NEW_EN_HYPHEN)
[grammar] ~19-~19: Use a hyphen to join words.
Context: ...ttle longer for us to react (e.g. out of office conditions), so please bear with ...
(QB_NEW_EN_HYPHEN)
🪛 markdownlint-cli2 (0.18.1)
SECURITY.md
17-17: Link text should be descriptive
(MD059, descriptive-link-text)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build and push image
- GitHub Check: Analyze (go)
🔇 Additional comments (2)
SECURITY.md (2)
1-7: LGTM!The header, policy version, and preface establish a professional tone and demonstrate the project's commitment to security. The grammar correction on line 7 ("committed to continuously working on improving") appears to have incorporated previous feedback.
15-23: Excellent addition: Clear vulnerability disclosure policy.This section successfully addresses the key blockers identified in issue #597. The policy now explicitly:
- Establishes a responsible disclosure process via confidential GitHub security issues
- Commits to CVE issuance and GitHub Security Advisories
- Provides reporter credit with anonymity options
- Distinguishes known issues from new vulnerabilities
This should significantly enable organizational adoption by removing security policy concerns.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 1516 @jannfis I'll plan these changes for you. Task: Apply nitpick improvements to SECURITY.md
⏳ Preparing changes... |
|
A summary of the changes CodeRabbit can apply:
|
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jann Fischer <jann@mistrust.net>
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
SECURITY.md (1)
19-19: Hyphenate compound adjective "out-of-office" (duplicate issue from past review).The phrase "out of office conditions" should use a hyphen when used as a compound adjective: "out-of-office conditions."
Apply this diff to fix the hyphenation:
-Sometimes, it might take a little longer for us to react (e.g. out of office conditions), so please bear with us in these cases. +Sometimes, it might take a little longer for us to react (e.g. out-of-office conditions), so please bear with us in these cases.
🧹 Nitpick comments (1)
SECURITY.md (1)
11-11: Consider tightening wordy phrasing (optional).The phrase "for the time being" could be replaced with "currently" or removed to improve conciseness. However, the current phrasing adequately conveys the temporary nature of the policy if you prefer to keep it.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
SECURITY.md(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-10-31T10:37:27.987Z
Learnt from: chetan-rns
Repo: argoproj-labs/argocd-agent PR: 632
File: test/data/pre-sync/pre-sync-job.yaml:2-17
Timestamp: 2025-10-31T10:37:27.987Z
Learning: In the argocd-agent repository, Kubernetes manifests under test/data/ directories are test fixtures for e2e testing and do not require production-grade security hardening such as securityContext settings for runAsNonRoot or allowPrivilegeEscalation.
Applied to files:
SECURITY.md
🪛 LanguageTool
SECURITY.md
[style] ~11-~11: This is not the usual sequence for adjectives that have no special emphasis.
Context: .... ## Supported Versions Only the most recent minor release (e.g. 1.0 or 1.1) will receive ...
(EN_ADJ_ORDER)
[style] ~11-~11: This phrasing can be wordy. For improved clarity, try opting for something more concise.
Context: ...1.0 or 1.1) will receive security fixes for the time being, and no back-ports will be made. ## Re...
(FOR_THE_TIME_BEING)
[grammar] ~19-~19: Use a hyphen to join words.
Context: ... little longer for us to react (e.g. out of office conditions), so please bear wi...
(QB_NEW_EN_HYPHEN)
[grammar] ~19-~19: Use a hyphen to join words.
Context: ...ttle longer for us to react (e.g. out of office conditions), so please bear with ...
(QB_NEW_EN_HYPHEN)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build and push image
- GitHub Check: Analyze (go)
🔇 Additional comments (3)
SECURITY.md (3)
1-3: Strong opening with formal policy header.The addition of the title refinement and policy version tracking is professional and appropriate for a security policy document.
5-7: Clear security commitment statement.The Preface effectively establishes the project's security posture and appears to incorporate corrections from the previous review cycle.
15-23: Comprehensive vulnerability reporting workflow addresses PR objectives.The expanded Reporting a Vulnerability section establishes a clear, professional responsible disclosure process with CVE commitment, GitHub Security Advisories integration, and reporter credit options. This directly addresses the concerns raised in issue #597 and should facilitate organizational adoption.
|
Creating a commit in the current branch to apply the edits... The changes have been committed to the current branch. Commit ID: |
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
SECURITY.md(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-10-31T10:37:27.987Z
Learnt from: chetan-rns
Repo: argoproj-labs/argocd-agent PR: 632
File: test/data/pre-sync/pre-sync-job.yaml:2-17
Timestamp: 2025-10-31T10:37:27.987Z
Learning: In the argocd-agent repository, Kubernetes manifests under test/data/ directories are test fixtures for e2e testing and do not require production-grade security hardening such as securityContext settings for runAsNonRoot or allowPrivilegeEscalation.
Applied to files:
SECURITY.md
🪛 LanguageTool
SECURITY.md
[style] ~11-~11: This is not the usual sequence for adjectives that have no special emphasis.
Context: .... ## Supported Versions Only the most recent minor version (e.g. 1.0 or 1.1) will receive ...
(EN_ADJ_ORDER)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build and push image
- GitHub Check: Analyze (go)
🔇 Additional comments (1)
SECURITY.md (1)
1-23: Substantive policy update effectively addresses issue #597.The rewritten security policy now clearly commits to a responsible disclosure process via confidential GitHub security issues, publication of security advisories through GitHub's feature, issuance of CVEs, and optional reporter credit/anonymity. This directly resolves the blockers identified in issue #597 (absence of responsible disclosure process and no CVE commitment). The support policy limiting fixes to the latest minor version is explicit and actionable.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jann Fischer <jann@mistrust.net>
What does this PR do / why we need it:
Update argocd-agent's security policy to let people know how to report vulnerabilities in a confidential manner, and how we will handle them.
Which issue(s) this PR fixes:
Fixes #597
How to test changes / Special notes to the reviewer:
Checklist
Summary by CodeRabbit