feat: Add common Security overview file#20
Merged
Conversation
Copied from supabase/sdk GitHub repository.
There was a problem hiding this comment.
Pull request overview
Adds an organization-level SECURITY.md to this .github repo so GitHub can inherit and display consistent security reporting guidance across repositories, reducing duplicated and divergent security instructions.
Changes:
- Introduces a new
SECURITY.mdwith vulnerability reporting, testing, disclosure, and response expectations. - Links to the Supabase HackerOne VDP and canonical
security.txt.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Jun 29, 2026
spydon
added a commit
to supabase/supabase-flutter
that referenced
this pull request
Jun 30, 2026
## What Removes this repo's `SECURITY.md` so it inherits the organization-wide security policy maintained centrally in `supabase/.github`. References supabase/.github#20 ## Why The security policy is being consolidated into a single org-wide default (`supabase/.github`) instead of being duplicated across every repository. GitHub serves that default as the "Security policy" for any repo that doesn't define its own, so this file is now redundant. ## Note Please do not merge until supabase/.github#20 is merged, otherwise this repo would briefly show no security policy.
spydon
added a commit
to supabase/auth
that referenced
this pull request
Jul 1, 2026
## What Removes this repo's `SECURITY.md` so it inherits the organization-wide security policy maintained centrally in `supabase/.github`. References supabase/.github#20 ## Why This repo's `SECURITY.md` is a stale fork of an older policy and now **conflicts** with the canonical org-wide one: - Reporting channel: it directs reporters to email `security@supabase.io` and request a scanner sandbox, whereas the canonical policy uses the HackerOne VDP (`hackerone.com/supabase`). - SLA: it promises a response "within 3 business days" versus the canonical "within 5 business days". Inheriting the single org-wide default keeps the disclosure process consistent across every repository. ## Note Please do not merge until supabase/.github#20 is merged, otherwise this repo would briefly show no security policy.
spydon
added a commit
to supabase/supabase
that referenced
this pull request
Jul 1, 2026
## What Removes this repo's `SECURITY.md` so it inherits the organization-wide security policy maintained centrally in `supabase/.github`. References supabase/.github#20 ## Why The security policy is being consolidated into a single org-wide default (`supabase/.github`) instead of being duplicated across every repository. GitHub serves that default as the "Security policy" for any repo that doesn't define its own, so this file is now redundant. ## Note Please do not merge until supabase/.github#20 is merged, otherwise this repo would briefly show no security policy. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Removed the public security contact file previously available at the `.well-known/security.txt` path. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Adds a
SECURITY.mdfile so that it may be inherited by other repositories in our org.As described in: Creating a default community health file: Supported file types
What is the current behavior?
Repositories are creating their own
SECURITY.mdfiles, duplicating this common content (anti-DRY) and sometimes with mild differences (likesecurity@supabase.iovssecurity@supabase.com).What is the new behavior?
Once this is merged to the
mainbranch in this repository then GitHub should display a 'Security' overview tab on repositories where it currently doesn't because they don't have their own, explicitSECURITY.mdfile.