add security policy directory by Ryun1 · Pull Request #132 · IntersectMBO/Open-Source-Office

Ryun1 · 2025-10-23T20:33:07Z

List of changes

Add directory of security policies
Add a suggested v1.1 policy

Ranchhand87 · 2025-12-15T13:38:24Z

https://github.com/IntersectMBO/Open-Source-Office/security/advisories/new

Please update to reflect this link within the revised Security policy.

CC: @Emmanuel-Tyty @HarunJr

Ranchhand87 · 2025-12-18T12:40:09Z

@ThatGuyLLC Please give some thoughts on this.

Ranchhand87 · 2026-03-26T13:48:36Z

https://github.com/IntersectMBO/Open-Source-Office/security/advisories/new

Please update to reflect this link within the revised Security policy.

CC: @Emmanuel-Tyty @HarunJr

@Emmanuel-Tyty @HarunJr can one of y'all audit this?

HarunJr

Thanks for putting this together! The updates look good.

I just caught one minor typo that exists in both of the templates. Other than that it looks good to me.

HarunJr · 2026-04-02T12:41:13Z

+
+5. **Fixing Issue**: The team agrees on the fix, the announcement, and the release schedule with the reporter. If the reporter is not responsive in a reasonable time frame this should not block the team from moving to the next steps particularly in the face of a high impact or high severity issue.
+
+   a. **Mitigation**: Depending on the severity and criticity of the issue, the team can decide to disclose the issue publicly in the absence of a fix _if and only if_ a clear, simple, and effective mitigation plan is defined. This _must_ include instructions for users and operators of the software, and a time horizon at which the issue will be properly fixed (eg. version number).


On line 53. Change "Depending on the severity and [criticity] of the issue..." to "Depending on the severity and [criticality] of the issue..."

Ranchhand87 · 2026-04-07T15:20:37Z

+If you discover a security vulnerability in xxxx, we encourage you to
+responsibly disclose it to us. To report a vulnerability, please use
+the [private reporting form on
+GitHub](https://github.com/input-output-hk/mithril/security/advisories/new)


Ranchhand87 · 2026-04-07T15:20:47Z

+
+- A description of the vulnerability and its potential impact.
+- Steps to reproduce the vulnerability.
+- The version of `xxxx` package where the vulnerability exists.


Ranchhand87 · 2026-04-07T15:20:54Z

+
+## Introduction
+
+The Cardano open source project (xxx) is committed to ensuring the security of


Ranchhand87 · 2026-04-07T15:21:32Z

+## Contact Information
+
+To report a security vulnerability, please use [GitHub
+form]((add project github form for your project)). Should you experience any issues reporting via GitHub or have other questions, Please contact [Security](security@intersectmbo.org).


Ranchhand87 · 2026-04-07T15:21:51Z

+
+5. **Fixing Issue**: The team agrees on the fix, the announcement, and the release schedule with the reporter. If the reporter is not responsive in a reasonable time frame this should not block the team from moving to the next steps particularly in the face of a high impact or high severity issue.
+
+   a. **Mitigation**: Depending on the severity and criticity of the issue, the team can decide to disclose the issue publicly in the absence of a fix _if and only if_ a clear, simple, and effective mitigation plan is defined. This _must_ include instructions for users and operators of the software, and a time horizon at which the issue will be properly fixed (eg. version number).


Ranchhand87 · 2026-04-07T15:22:10Z

+
+This Security Vulnerability Disclosure Policy may be updated or
+revised as necessary. Please check the latest version of this policy
+on the [xxxx repository]((add link for your project)).


Ranchhand87 · 2026-04-07T15:22:16Z

+
+## Conclusion
+
+The xxxx project greatly appreciates the assistance of the security


- Correct "criticity" typos in v1.0 and v1.1 templates - Add functional GitHub security advisory links to all policies - Update root SECURITY.md with project-specific reporting details

Ranchhand87 · 2026-04-21T11:55:18Z

 ## Introduction

-The Cardano open source project (xxx) is committed to ensuring the security of
+{PROJECT-NAME} is committed to ensuring the security of


This is Open-Source-Office.

I would like this updated to match the repo. We can set up a separate DRAFT.md if needed to show the outline. This is likely more appropriate on Dev-ex, dev portal, and gitbook though.

Understood. I'll move the entire security-policy-documents/ folder to the Dev-Ex repo where it belongs as a reusable template. This repo will keep a single root SECURITY.md, consistent with all other IntersectMBO repos.

Maybe not the whole file. This is OSO owned. Additionally similar to other Intersect Repos you have a matching Security.md File. Maybe if you were to create a how to fill out the Template, there would be value. Admittedly though, I imagine updating Security.md to match the repo is quite the simple task that a developer of any skill level should be able to complete.

Ranchhand87 · 2026-04-21T11:55:27Z

 ### Reporting a Vulnerability

-If you discover a security vulnerability in xxxx, we encourage you to
+If you discover a security vulnerability in {PROJECT-NAME}, we encourage you to


Ranchhand87 · 2026-04-21T11:55:47Z

 - A description of the vulnerability and its potential impact.
 - Steps to reproduce the vulnerability.
- The version of `xxxx` package where the vulnerability exists.
+- The version of {PROJECT-NAME} package where the vulnerability exists.


Ranchhand87 · 2026-04-21T11:56:17Z

 ## Conclusion

-The xxxx project greatly appreciates the assistance of the security
+The {PROJECT-NAME} project greatly appreciates the assistance of the security


Just realized this is the historical record, let's anonymize all of this. Or update Open-Source-Office. Pick one and ensure each document matches holistically. Thanks

Ranchhand87 · 2026-04-21T12:00:04Z

 ## Contact Information

-To report a security vulnerability, please use {SOMETHING}. Should you experience any issues reporting via GitHub or have other questions, please contact [security@intersectmbo.org](mailto:security@intersectmbo.org).
+To report a security vulnerability, please use the [security advisory form on GitHub](https://github.com/IntersectMBO/Open-Source-Office/security/advisories/new). Should you experience any issues reporting via GitHub or have other questions, please contact [security@intersectmbo.org](mailto:security@intersectmbo.org).


Does the email look better with the tail? Or simply as 'Security'?

It's more explicit with the tail IMO, I'll use the full address format: [security@intersectmbo.org](mailto:security@intersectmbo.org).

Ranchhand87 · 2026-04-21T12:01:47Z

-Please report (suspected) security vulnerabilities to security@intersectmbo.org. You will receive a
+The preferred method for reporting a vulnerability is through the [security advisory form on GitHub](https://github.com/IntersectMBO/Open-Source-Office/security/advisories/new).
+
+Alternatively, you can report (suspected) security vulnerabilities to security@intersectmbo.org. You will receive a


Is the email properly linked here?

Ranchhand87 · 2026-04-21T12:02:57Z

 vulnerability, please mention them in your email but ***DO NOT*** attempt to include them as
 attachments as this may cause your Email to be blocked by spam filters.
+
 See the security file in the [Cardano engineering handbook](https://github.com/input-output-hk/cardano-engineering-handbook/blob/main/SECURITY.md).


Let's check this. I know that we still refer to CEH, but I am not confident that it has been updated with a Matching Security policy. Maybe this is a conversation you can pick up with @rober-m

I'll remove the CEH reference, the root SECURITY.md is now based on v1.1 which is self-contained. I'll follow up with @rober-m separately to check whether the CEH SECURITY.md needs updating to align with this policy.

Replaces the minimal placeholder file with the complete v1.1 security disclosure policy, substituting Open-Source-Office throughout and fixing the email to a proper mailto link. Removes the stale Cardano Engineering Handbook cross-reference.

add suggested updated security policy

31cd6e9

Ryun1 requested review from Ranchhand87 and ThatGuyLLC as code owners October 23, 2025 20:33

add pointer to OSO repo

c88a650

HarunJr requested review from HarunJr and removed request for ThatGuyLLC April 2, 2026 12:28

HarunJr reviewed Apr 2, 2026

View reviewed changes

Ranchhand87 reviewed Apr 7, 2026

View reviewed changes

Ranchhand87 assigned HarunJr Apr 7, 2026

docs: update security policies and fix typos

79d1139

- Correct "criticity" typos in v1.0 and v1.1 templates - Add functional GitHub security advisory links to all policies - Update root SECURITY.md with project-specific reporting details

Ranchhand87 requested changes Apr 21, 2026

View reviewed changes

HarunJr added 2 commits April 22, 2026 17:56

fix: resolve merge conflicts in SECURITY.md

9a87db5

HarunJr requested a review from Ranchhand87 April 22, 2026 16:23


		5. Fixing Issue: The team agrees on the fix, the announcement, and the release schedule with the reporter. If the reporter is not responsive in a reasonable time frame this should not block the team from moving to the next steps particularly in the face of a high impact or high severity issue.

		a. Mitigation: Depending on the severity and criticity of the issue, the team can decide to disclose the issue publicly in the absence of a fix _if and only if_ a clear, simple, and effective mitigation plan is defined. This _must_ include instructions for users and operators of the software, and a time horizon at which the issue will be properly fixed (eg. version number).


		## Introduction

		The Cardano open source project (xxx) is committed to ensuring the security of


		## Conclusion

		The xxxx project greatly appreciates the assistance of the security

Conversation

Ryun1 commented Oct 23, 2025

List of changes

Uh oh!

Ranchhand87 commented Dec 15, 2025

Uh oh!

Ranchhand87 commented Dec 18, 2025

Uh oh!

Ranchhand87 commented Mar 26, 2026

Uh oh!

HarunJr left a comment

Choose a reason for hiding this comment

Uh oh!

HarunJr Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

HarunJr Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

HarunJr Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

HarunJr Apr 2, 2026 •

edited

Loading

HarunJr Apr 22, 2026 •

edited

Loading

HarunJr Apr 22, 2026 •

edited

Loading