Post #1860142
2026-05-01 17:53 UTC
@davidism I wonder if your experience would meaningfully change if the text for your security policy was checked into the repository.
The ".github" pattern is useful for not having to duplicate everything everywhere, but I wonder how effective that is for generative AI scanning tools which likely aren't pulling the .github repo to discover org-wide security policies and threat models.
Replies (2)
-
@sethmlarson@mastodon.social 2026-05-01 17:58
@davidism Of course, the human in the loop (the reporter, NOT the maintainer) SHOULD be the one comparing the outputs to the security model you've documented. I suspect the same folks who are /only now/ emboldened to scan OSS repositories for vulnerabilities aren't likely to read security policies.
-
@a@fedi.lawngno.me 2026-05-01 18:09
@sethmlarson @davidism Even a link might be sufficient. These scanning tools tend to be very repo-oriented right now. Taking Flask as an example, I'd personally probably get to the security policy via the link to the contribution guide, but smacking people in the face more obviously with a SECURITY.md or update to the README — even if it's just a link — might improve the signal:noise.