[Marius Storhaug (MariusStorhaug)]

Private vulnerability reporting instructions give the availability condition before the command to use the repository's Security tab. The email fallback and reporting policies stay unchanged.

Fixed: The private-reporting condition comes first

Reporters read the availability prerequisite before the instruction. The sentence keeps its direct imperative form. No reporting route, policy, or required reporter action changes.

---

Technical details

The diff changes only .github/SECURITY.md:15-16: two insertions and two deletions in one small commit. Baseline: 0c67251812ea306543f3a14ab473ae357cfb76ac. Candidate: a45e33912b4fc594e090dd291271946ed6ce9dcb. The remote PR file list and local/upstream commit identities match.

Evidence	First sentence
Before	Use the affected repository's **Security** tab to report the vulnerability privately when private vulnerability reporting is available.
After	When private vulnerability reporting is available, use the affected repository's **Security** tab to report the vulnerability privately.

The existing clause moves before the command. The comma separates the condition from the imperative. The email fallback is unchanged.

The pre-edit evidence and complete policy-preservation checklist were recorded before editing. The full verification record records exact policy, heading, link, and scope commands with results. The comparison confirms that all other text is unchanged: supported-release/default-branch policy and precedence; public-disclosure prohibitions; private routes and addresses; sensitive information, credentials, secrets, and weak controls; all requested reporter evidence; private investigation and coordinated remediation/disclosure. No service level, deadline, reporting channel, feature enablement, or enforcement claim is added.

.github/SUPPORT.md is reviewed and unchanged. It already gives ordered public-help steps, sanitized-evidence instructions, private support, and security, conduct, and contribution routes. It tells reporters to remove credentials, personal information, and other secrets before posting. Its Git blob remains 18cdd55b35a3c0bd87165bbc96f131bf9f8ec83d. Headings and all five link targets are unchanged; three relative targets resolve and the two email targets retain their exact addresses. No test report or email was sent, and mailbox delivery is not asserted. Contributor Covenant text and all other owned campaign paths remain untouched.

The source review uses MSXOrg/docs commit 1b0d4893c8fefabe604d04393068a8ff6f848082: Documentation Model, Natural Language, Writing Guide, Markdown, Documentation, and applicable implementation, contribution, PR, commit, branching, and readiness guidance.

The official overview, FAQ, and Issue 9, Part 1, rule 5.4 (page 1-5-4), support the condition-first change. The reference PDF MD5 matches the official record: 9c720341c350ed77943b2c73d01c716f. Reference copies stay local. This is a focused rule review, not a claim of full STE conformance. GitHub's reporting guide confirms that private vulnerability reporting depends on repository enablement; the policy remains conditional.

Verification

Exact test-first command:

$policy = (Get-Content -LiteralPath '.github\SECURITY.md' -Raw) -replace '\s+', ' '; $expected = "When private vulnerability reporting is available, use the affected repository's **Security** tab to report the vulnerability privately."; if (-not $policy.Contains($expected)) { Write-Output 'FAIL (expected baseline): The availability prerequisite does not precede the Security tab instruction.'; exit 1 }; Write-Output 'PASS: The availability prerequisite precedes the Security tab instruction.'

Result: expected failure before editing, exit 1; passed after editing, exit 0.

Exact full-policy and scope command:

$ErrorActionPreference = 'Stop'
$base = '0c67251812ea306543f3a14ab473ae357cfb76ac'
$before = (git show "${base}:.github/SECURITY.md") -join "`n"
if ($LASTEXITCODE -ne 0) { throw 'Could not read the security baseline.' }
$old = "Use the affected repository's **Security** tab to report the vulnerability`nprivately when private vulnerability reporting is available. If that option is"
$new = "When private vulnerability reporting is available, use the affected repository's`n**Security** tab to report the vulnerability privately. If that option is"
if ([regex]::Matches($before, [regex]::Escape($old)).Count -ne 1) { throw 'The baseline instruction is not unique.' }
$after = (Get-Content -LiteralPath '.github\SECURITY.md') -join "`n"
if ($after -cne $before.Replace($old, $new)) { throw 'Unexpected security policy change.' }
Write-Output 'PASS: SECURITY.md is identical to the baseline except for the approved condition-order replacement.'
$beforeSupport = (git show "${base}:.github/SUPPORT.md") -join "`n"
if ($LASTEXITCODE -ne 0) { throw 'Could not read the support baseline.' }
$afterSupport = (Get-Content -LiteralPath '.github\SUPPORT.md') -join "`n"
if ($afterSupport -cne $beforeSupport) { throw 'Unexpected support policy change.' }
Write-Output 'PASS: SUPPORT.md is identical to the baseline.'
$changedPaths = @(git diff --name-only $base)
if ($LASTEXITCODE -ne 0 -or $changedPaths.Count -ne 1 -or $changedPaths[0] -cne '.github/SECURITY.md') { throw 'Unexpected changed paths.' }
Write-Output 'PASS: The only changed path is .github/SECURITY.md.'
git --no-pager diff --check $base
if ($LASTEXITCODE -ne 0) { throw 'Whitespace validation failed.' }
Write-Output 'PASS: git diff --check 0c67251812ea306543f3a14ab473ae357cfb76ac.'

Result: passed, exit 0; all four PASS messages were produced. This proves that the approved clause-order replacement is the only security-policy change and that support is unchanged.

Compact direct-link command:

'.github\SECURITY.md', '.github\CODE_OF_CONDUCT.md', '.github\CONTRIBUTING.md' | ForEach-Object { if (-not (Test-Path -LiteralPath $_ -PathType Leaf)) { throw "Missing link target: $_" }; "PASS: $_" }; Select-String -LiteralPath '.github\SECURITY.md', '.github\SUPPORT.md' -Pattern '\[[^\]]+\]\([^)]+\)'

Result: passed, exit 0; three relative targets exist and all five original links are listed. The full link/heading comparison in the issue record also passed, exit 0.

Exact command	Result
git --no-pager diff --check 0c67251812ea306543f3a14ab473ae357cfb76ac..HEAD	Passed, exit 0.
git --no-pager diff --cached --check	Passed before commit, exit 0.
git --no-pager diff --exit-code 0c67251812ea306543f3a14ab473ae357cfb76ac -- .github\SUPPORT.md	Passed, exit 0; no support diff.
git hash-object .github\SUPPORT.md	Matched the baseline support blob above.
gh api repos/MSXOrg/.github/commits/a45e33912b4fc594e090dd291271946ed6ce9dcb/check-runs --jq '{total_count, check_runs: [.check_runs[] | {name, status, conclusion}]}'	Succeeded; the final snapshot contains one completed, successful copilot-pull-request-reviewer check. This is not a Markdown/link CI result.

This base has no Markdown/link validation scripts, linter configuration, package manifest, or workflow. No checks from unmerged #12 are installed or claimed. The successful review check does not fill that separate readiness gap. No linter, dependency, validation file, or release metadata is added.

Alignment and plan progress

Changed surface	Standards checked	Framework docs checked	Result
.github/SECURITY.md	Pinned MSX documentation, natural-language, Markdown, implementation, and PR guidance; official Issue 9 rule 5.4	None (no framework-specific docs); GitHub private-reporting behavior checked	Fixed in this PR

Source review, pre-edit evidence, implementation, full-policy comparison, direct link verification, whitespace checks, and direct self-review are complete. The issue plan is updated as those steps finish. The draft was opened after the first small commit. The native Task has no blocked-by edges or recorded parent.

Scoped convergence searches used gh issue list --repo MSXOrg/.github --state open --search '"SECURITY.md" in:body' --limit 30 --json number,title,body,url and the same command with "SUPPORT.md". Each returned only #18. No other issue converges or is added to the closing references.

A review was explicitly requested with gh pr edit 19 --repo MSXOrg/.github --add-reviewer '@copilot'; the request succeeded. The submitted review is APPROVED at candidate a45e33912b4fc594e090dd291271946ed6ce9dcb, with no inline comments or open review issues. An independent acceptance review at the same candidate also found no blocking scope or policy issue. The final metadata check confirms that every original PR-template comment and heading is preserved in order, and that only the delivery leaf is closed by this PR.

This PR stays in draft by request. No merge, auto-merge, or Agent merge action is taken. No implementation blocker remains for the requested reviewed-draft handoff; hosted Markdown/link CI remains unavailable as recorded above.

Relevant issues (or links)

Resolves #18.

References #12 for the separate validation work; its unmerged files are not part of this PR.

[Copilot]

🟢 Approved

No active review issues remain for this documentation-only reordering of the security reporting guidance.

No open issues 🎉

What changed in this PR

This documentation-only change makes the organization’s default security reporting guidance condition-first without changing reporting routes or policies.

Changes:

• Places the private-reporting availability condition before the instruction to use the repository’s Security tab.
• Preserves the email fallback and all other policy text.

File	Description
.github/​SECURITY.md	Reorders the private-reporting sentence so the prerequisite comes before the action.

_{Review effort: Balanced}