Post #1860132
2026-04-30 13:46 UTC
Turns out we already have that in our security policy, and people just ignore it. What a surprise 🙄 https://palletsprojects.com/security I added another sentence to make it even clearer.
Replies (1)
-
@sethmlarson@mastodon.social 2026-05-01 17:53
@davidism I wonder if your experience would meaningfully change if the text for your security policy was checked into the repository. The ".github" pattern is useful for not having to duplicate everything everywhere, but I wonder how effective that is for generative AI scanning tools which likely aren't pulling the .github repo to discover org-wide security policies and threat models.