Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds operational security (opsec) documentation to the Aztec Staking Dashboard repository, establishing clear guidelines for security vulnerability reporting and code ownership.
Changes:
- Added a comprehensive SECURITY.md file with private vulnerability reporting guidelines and contact information
- Updated CONTRIBUTING.md to reference the security policy for security-sensitive issues
- Introduced a CODEOWNERS file to define default code review ownership
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| SECURITY.md | New security policy document defining vulnerability reporting process, email contact, and distinguishing between security and non-security issues |
| CONTRIBUTING.md | Added reference to SECURITY.md for security-sensitive bug reports to ensure proper private disclosure |
| .github/CODEOWNERS | New file establishing @AztecProtocol/sdb-review team as default owners for all repository files |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| If you believe a vulnerability is actively being exploited or has severe impact (e.g. loss of funds, key compromise, or broad user impact), please clearly mark the report as **CRITICAL** in the pvr/email subject. | ||
|
|
||
| ## Reporting Non‑Security Bugs and Feature Requests |
There was a problem hiding this comment.
The heading uses a non-breaking hyphen (U+2011) instead of a standard hyphen. This should be changed to use a regular hyphen for consistency and to avoid potential issues with text processing tools and search functionality.
| ## Reporting Non‑Security Bugs and Feature Requests | |
| ## Reporting Non-Security Bugs and Feature Requests |
| 2. Steps to reproduce (including logs, requests, or PoCs as appropriate) | ||
| 3. Environment details (browser, OS, network assumptions) | ||
|
|
||
| You can also email security@aztec.foundation |
There was a problem hiding this comment.
This sentence is missing ending punctuation. Add a period at the end for consistency with standard sentence structure.
| You can also email security@aztec.foundation | |
| You can also email security@aztec.foundation. |
|
|
||
| - **Do not** open public GitHub issues or pull requests for suspected security vulnerabilities. | ||
|
|
||
| Instead, please use the [Private Vulnerability Reporting](https://github.com/AztecProtocol/staking-dashboard/security/advisories/new) process on GitHub. |
There was a problem hiding this comment.
There is a trailing space at the end of this line after "GitHub." which should be removed for clean formatting.
| Instead, please use the [Private Vulnerability Reporting](https://github.com/AztecProtocol/staking-dashboard/security/advisories/new) process on GitHub. | |
| Instead, please use the [Private Vulnerability Reporting](https://github.com/AztecProtocol/staking-dashboard/security/advisories/new) process on GitHub. |
2 participants
No description provided.