Skip to content

feat: Add common Security overview file#20

Merged
QuintinWillison merged 2 commits into
mainfrom
inherit-security-ov-file
Jun 29, 2026
Merged

feat: Add common Security overview file#20
QuintinWillison merged 2 commits into
mainfrom
inherit-security-ov-file

Conversation

@QuintinWillison

@QuintinWillison QuintinWillison commented Jun 29, 2026

Copy link
Copy Markdown
Member

What kind of change does this PR introduce?

Adds a SECURITY.md file so that it may be inherited by other repositories in our org.

As described in: Creating a default community health file: Supported file types

What is the current behavior?

Repositories are creating their own SECURITY.md files, duplicating this common content (anti-DRY) and sometimes with mild differences (like security@supabase.io vs security@supabase.com).

What is the new behavior?

Once this is merged to the main branch in this repository then GitHub should display a 'Security' overview tab on repositories where it currently doesn't because they don't have their own, explicit SECURITY.md file.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds an organization-level SECURITY.md to this .github repo so GitHub can inherit and display consistent security reporting guidance across repositories, reducing duplicated and divergent security instructions.

Changes:

  • Introduces a new SECURITY.md with vulnerability reporting, testing, disclosure, and response expectations.
  • Links to the Supabase HackerOne VDP and canonical security.txt.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread SECURITY.md
Comment thread SECURITY.md
Comment thread SECURITY.md

@staaldraad staaldraad left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔥

@QuintinWillison
QuintinWillison merged commit 5c94fa2 into main Jun 29, 2026
3 checks passed
@QuintinWillison
QuintinWillison deleted the inherit-security-ov-file branch June 29, 2026 18:04
spydon added a commit to supabase/supabase-flutter that referenced this pull request Jun 30, 2026
## What

Removes this repo's `SECURITY.md` so it inherits the organization-wide
security policy maintained centrally in `supabase/.github`.

References supabase/.github#20

## Why

The security policy is being consolidated into a single org-wide default
(`supabase/.github`) instead of being duplicated across every
repository. GitHub serves that default as the "Security policy" for any
repo that doesn't define its own, so this file is now redundant.

## Note

Please do not merge until supabase/.github#20 is merged, otherwise this
repo would briefly show no security policy.
spydon added a commit to supabase/auth that referenced this pull request Jul 1, 2026
## What

Removes this repo's `SECURITY.md` so it inherits the organization-wide
security policy maintained centrally in `supabase/.github`.

References supabase/.github#20

## Why

This repo's `SECURITY.md` is a stale fork of an older policy and now
**conflicts** with the canonical org-wide one:

- Reporting channel: it directs reporters to email
`security@supabase.io` and request a scanner sandbox, whereas the
canonical policy uses the HackerOne VDP (`hackerone.com/supabase`).
- SLA: it promises a response "within 3 business days" versus the
canonical "within 5 business days".

Inheriting the single org-wide default keeps the disclosure process
consistent across every repository.

## Note

Please do not merge until supabase/.github#20 is merged, otherwise this
repo would briefly show no security policy.
spydon added a commit to supabase/supabase that referenced this pull request Jul 1, 2026
## What

Removes this repo's `SECURITY.md` so it inherits the organization-wide
security policy maintained centrally in `supabase/.github`.

References supabase/.github#20

## Why

The security policy is being consolidated into a single org-wide default
(`supabase/.github`) instead of being duplicated across every
repository. GitHub serves that default as the "Security policy" for any
repo that doesn't define its own, so this file is now redundant.

## Note

Please do not merge until supabase/.github#20 is merged, otherwise this
repo would briefly show no security policy.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Removed the public security contact file previously available at the
`.well-known/security.txt` path.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants