827ad41ea6
Defers to the org policy for how to report and covers what is particular to a repository that is a sanitised mirror: the most valuable report here is not a crash, it is something REAL that should not be here - a credential, an internal hostname, an operator path, an identifier naming a private project. Mail those rather than filing an issue, because a public issue about a leaked secret publishes it a second time. It also says what the automated check is and is not. The sanitisation suite is a DENYLIST: it proves the absence of known patterns, not the absence of secrets. Green tests are why a human report is still worth sending. And the ordinary warning for what these actually are - automation that archives a tree, uploads it, rebuilds containers and restarts services. Read before running, nothing here is a sandbox, the config is yours to replace. TWINS ARE NOW DISCOVERED, NOT LISTED. PAIRS was hand-kept and two files had outgrown it: ELEVATOR_PITCH.md and TOKEN_SAVINGS.md had no twin at all. Adding a document and remembering to add it to a list are two acts, and the second is the one that gets skipped. The Pester test had the same shape in reverse - it scraped PAIRS out of the generator's source, so it could only prove the list was self-consistent and a document nobody listed was invisible to it. It now asks the REPOSITORY what markdown it has. Proven by deleting SECURITY.txt and watching two tests fail. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
3.2 KiB
Security
How to report a vulnerability, what to expect, and what is in scope: the evomedia-net security policy. Short version — email dev@evomedia.net, not a public issue.
What follows is particular to this repository, which is unusual in one way worth stating plainly.
This is a mirror, and the interesting bug is a leak
These scripts are published from a private tree. The copy here is sanitised: placeholder hosts, example configuration, dummy data. So the most valuable thing anyone can report about this repository is not a crash — it is something real that should not be here:
- a credential, key, token, or private-key block
- an internal hostname, a product domain, or an operator's path
- an identifier that names a private project or a private-only script
If you find one, treat it as a live secret and mail dev@evomedia.net rather than opening an issue. A public issue about a leaked secret publishes it a second time and pins it to the top of the page.
The automated check is a denylist. tests/Sanitization.Tests.ps1 and
tests/sanitization-patterns.psd1 hold the patterns this repository must never
contain, and CI enforces them. A denylist proves the absence of known
patterns, not the absence of secrets — it is a regression net for a specific
recurring mistake, not a substitute for reading what is published. That is why
a report here is worth sending even though the tests are green.
They are automation scripts, so read them before running them
Everything here drives real infrastructure: archives a working tree, uploads it, rebuilds containers, restarts services. That is the purpose, and it means the ordinary rules for running someone else's shell scripts apply with more force than usual.
- Read a script before the first run, and run it against something you can afford to break.
- Nothing here is a sandbox. There is no dry-run guarantee unless a script documents one; the flag that exists on one command may not exist on the next.
- The configuration is yours. The example config carries placeholders, and every host, key path and target in it has to be replaced with your own before anything is pointed at real infrastructure.
- Addresses in examples use the ranges reserved for documentation, and loopback. They are placeholders, not somewhere to send anything.
Scripts that destroy or overwrite state are the ones to read twice. A report that one of them does something destructive without saying so is a good report; a report that a script named after a destructive act performs it is not.
Release integrity
Releases carry checksums. They are an integrity check, not a signature — they catch a truncated download, a corrupted mirror and an accidental edit, and they do not catch a forger, because whoever can change an archive can change the manifest that travels with it.
Not a finding here
- Placeholder credentials and example configuration. Fake values are the sanitisation working, not a leak.
- The private tree. Only what is published here is in scope; the internal original is not public and cannot be reviewed.