docs(security): align the policy with the published one - #88
Conversation
Two contradictions with taskade.com/security, which is the canonical policy. The acknowledgement promise. This file committed to 3 business days; the published policy states plainly that we are a small team and do not guarantee a response time. A researcher can hold us to the shorter one, and support is covered by one person. The contact address. This file gave hello@; the published policy gives support@, which is the monitored mailbox routed to engineering. Also states what the published policy says about disclosure, credit and the absence of a bounty, and defers to it explicitly so the two cannot drift again. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Self-review: the rewrite dropped 'subject to investigation requirements' from the published disclosure term, which is the same kind of over-commitment this PR exists to remove. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot review overview
馃煝 Approval recommended
The documentation changes are focused, internally consistent, and match the canonical organization policy.
Review effort: Balanced
Findings: None
What changed in this PR
Aligns the repository security policy with Taskade鈥檚 canonical reporting terms.
Changes:
- Updates the reporting email and response-time expectations.
- Adds disclosure, recognition, bounty, and policy-precedence terms.
| File | Description |
|---|---|
SECURITY.md |
Aligns vulnerability reporting guidance with the published policy. |
馃挕 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Why
SECURITY.mdhere contradicts the canonical policy at taskade.com/security in two ways, and both favour the reporter over what we can actually deliver.1. It promises an acknowledgement SLA we have not committed to anywhere else.
The published policy says the opposite, deliberately:
Support is covered by one person. A researcher who misses that window can point at this line as a broken commitment, which is exactly the leverage used to justify early public disclosure.
2. It gives the wrong contact address. This file says
hello@; the published policy sayssupport@taskade.com, "monitored by our support team and routed to engineering". There is nosecurity@anywhere, despite it being the intuitive guess.What changed
SECURITY.md, reporting section only:hello@becomessupport@taskade.comToken handling, transport security, secret hygiene and privacy sections are untouched.
Context
Part of a pass over the public repos. Private vulnerability reporting is now enabled here and on
taskade,integrations,cli,docsandtaskade-sample-app, so the advisory link at the top of this file is a working private channel. An org-wide default policy now lives intaskade/.github(taskade/.github#11) covering every repo without its own; this file overrides that default, which is why it needed fixing directly.Note
Left alone deliberately: the em-dash on line 5 and the arrow on line 7 are pre-existing, and this PR sticks to the two factual contradictions. Happy to sweep them separately.
馃 Generated with Claude Code