docs: add security policy - #31
Conversation
📝 WalkthroughWalkthroughAdded ChangesSecurity Reporting
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SECURITY.md`:
- Line 7: Update the private vulnerability reporting instructions in SECURITY.md
to use GitHub’s current Security & quality → Advisories → Report a vulnerability
flow if enabled for getAlby/mcp; otherwise, make the security@getalby.com email
route the primary reporting option and retain GitHub as an alternative only if
applicable.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
|
|
||
| Please report suspected security vulnerabilities privately. Do not open a public issue or disclose the vulnerability publicly until we have coordinated a fix. | ||
|
|
||
| The preferred way to report is GitHub's private vulnerability reporting: on the affected repository, go to the **Security** tab and click **Report a vulnerability** (or open `https://github.com/getAlby/mcp/security/advisories/new`). Alternatively, you can email [security@getalby.com](mailto:security@getalby.com). |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== SECURITY.md =="
if [ -f SECURITY.md ]; then
nl -ba SECURITY.md | sed -n '1,40p'
else
echo "SECURITY.md not found"
fi
echo
echo "== repository README mentions security/adv =="
fd -a 'README.*|SECURITY.*|CODEOWNERS' . | sed 's#^\./##' | head -80
rg -n -i "security|vulnerability|advisories|private vulnerability|report a vulnerability|security@" -g '!vendor/**' -g '!node_modules/**' -g '!dist/**' -g '!build/**' . | head -200 || true
echo
echo "== git status/diff summary =="
git status --short
git diff --stat || true
echo
echo "== repository config files =="
fd -a 'policy|security|dependabot|actions|github' . | sed 's#^\./##' | head -120Repository: getAlby/mcp
Length of output: 207
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== SECURITY.md =="
if [ -f SECURITY.md ]; then
cat -n SECURITY.md | sed -n '1,40p'
else
echo "SECURITY.md not found"
fi
echo
echo "== repository files =="
git ls-files | sed -n '1,160p'
echo
echo "== security-related references =="
grep -RIn -i "security|vulnerability|advisories|private vulnerability|report a vulnerability|security@" . --exclude-dir=node_modules --exclude-dir=vendor --exclude-dir=dist --exclude-dir=build 2>/dev/null | sed -n '1,200p' || true
echo
echo "== git status/diff summary =="
git status --short || true
git diff --stat || trueRepository: getAlby/mcp
Length of output: 1931
🌐 Web query:
GitHub security tab navigation Reports private vulnerability reporting Security and quality Advisories Report a vulnerability
💡 Result:
As of August 9, 2026, the navigation tab previously known as Security has been renamed to Security & quality [1]. This tab serves as the central hub for managing security and code quality findings across repositories, organizations, and enterprises [1]. Private vulnerability reporting (PVR) is a feature that allows security researchers to report vulnerabilities directly and privately to repository maintainers [2][3]. This process is managed through the following steps: 1. Access and Reporting: If a public repository has enabled private vulnerability reporting, a researcher can navigate to the repository, click the Security & quality tab, and select Report a vulnerability [2][4]. This opens a secure, structured form for submitting report details [4][3]. 2. Maintainer Management: Once a report is submitted, maintainers can view it within the Advisories section under the Security & quality tab [5]. They have several options for managing these reports: - Collaborate: They can start a temporary private fork to discuss and fix the vulnerability in private [5]. - Accept: They can accept the report to convert it into a draft repository security advisory [5]. - Communicate: They can comment on the advisory to request more information or close it if the report is not considered a security risk [5]. 3. Repository Advisories vs. Global Advisories: - Repository Security Advisories: These are created by maintainers to privately discuss and fix vulnerabilities [6]. After a patch is developed, they can be published to notify the community and potentially receive a CVE identification number [7][8][6]. - Global Security Advisories: These are curated, public advisories stored in the GitHub Advisory Database [9]. This database includes both GitHub-originated advisories and CVEs from external sources [10][9][11]. This system is distinct from the SECURITY.md file; private vulnerability reporting provides a structured, built-in workflow that does not require following instructions in a repository's security policy file [2]. Maintainers can enable or disable this feature via the Advanced Security settings within the repository's Settings menu [4].
Citations:
- 1: https://github.blog/changelog/2026-04-02-the-security-tab-is-now-security-quality/
- 2: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-a-vulnerability/privately-reporting-a-security-vulnerability
- 3: https://github.blog/security/vulnerability-research/a-maintainers-guide-to-vulnerability-disclosure-github-tools-to-make-it-simple/
- 4: https://docs.github.com/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository
- 5: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/manage-vulnerability-reports
- 6: https://docs.github.com/en/enterprise-cloud@latest/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories
- 7: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory
- 8: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory
- 9: https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/global-security-advisories
- 10: https://github.com/advisories
- 11: https://github.com/github/advisory-database
🌐 Web query:
GitHub code security docs configuring private vulnerability reporting Security and quality Advisories Report a vulnerability
💡 Result:
To configure private vulnerability reporting on a GitHub repository, repository owners and administrators can enable the feature within the repository settings [1][2]. Once enabled, security researchers are provided with a secure, structured interface to report vulnerabilities directly to maintainers, bypassing public channels [1][3]. How to enable private vulnerability reporting: 1. Navigate to the main page of the repository on GitHub [2]. 2. Click the Settings tab (if not visible, select the dropdown menu, then click Settings) [2]. 3. In the left sidebar, under the "Security" section, click Advanced Security [1][2]. 4. Under "Advanced Security," locate the "Private vulnerability reporting" section and click Enable [1][2]. Once enabled, a "Report a vulnerability" button becomes available on the repository's "Advisories" page [1][2]. Security researchers can use this button to submit a private report [4]. Upon submission, repository maintainers are notified, and the reporter is automatically added as a collaborator and credited user on the proposed security advisory [5][6][4]. It is important to note that private vulnerability reporting is distinct from the SECURITY.md file [5]. While private reporting handles the submission process securely, maintainers should still consider adding a security policy to provide instructions on their preferred disclosure process [7][8]. Additionally, maintainers should ensure their notification settings are configured appropriately to receive alerts for new private vulnerability reports [6]. For organizations, this feature can also be managed via custom security configurations [3][9].
Citations:
- 1: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository
- 2: https://docs.github.com/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository
- 3: https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/coordinated-disclosure
- 4: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-a-vulnerability/privately-reporting-a-security-vulnerability
- 5: https://docs.github.com/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability
- 6: https://github.blog/security/vulnerability-research/a-maintainers-guide-to-vulnerability-disclosure-github-tools-to-make-it-simple/
- 7: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting
- 8: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy
- 9: https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration
🏁 Script executed:
#!/bin/bash
set -euo pipefail
owner="getAlby"
repo="mcp"
echo "== repo metadata =="
gh api "repos/${owner}/${repo}" --jq '{name, default_branch, private, fork, open_issues_count}' 2>/dev/null || true
echo
echo "== repository settings/security-related metadata =="
gh api "repos/${owner}/${repo}" --jq '{advanced_security_enabled_for_new_repos, private_vulnerability_reporting_enabled, allow_vulnerability_alert_subscription, vulnerability_alerts}' 2>/dev/null || true
echo
echo "== package manager / lockfiles =="
for f in package.json yarn.lock pnpm-lock.yaml package-lock.json .npmrc; do
if [ -f "$f" ]; then
echo "--- $f ---"
sed -n '1,80p' "$f"
fi
doneRepository: getAlby/mcp
Length of output: 5272
Update the GitHub reporting instructions to the current Security & quality path.
GitHub now uses the Security & quality → Advisories → Report a vulnerability flow for private vulnerability reporting. Update SECURITY.md:7 if getAlby/mcp enables private reporting; otherwise, make the email route the primary option.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` at line 7, Update the private vulnerability reporting
instructions in SECURITY.md to use GitHub’s current Security & quality →
Advisories → Report a vulnerability flow if enabled for getAlby/mcp; otherwise,
make the security@getalby.com email route the primary reporting option and
retain GitHub as an alternative only if applicable.
1 participant
Summary
SECURITY.mdwith private vulnerability reporting guidancesecurity@getalby.comas contact optionsVerification
git diff --cached --checkSummary by CodeRabbit