Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Add SECURITY.md and enable secret scanning (missing on 3 of 4 OSE repos)

Abierto
  • ¿Algo no está bien?
#382 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
50/100
Tipo de issue
Documentación
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
github, markdown
Área
documentation, security

Línea de trabajo

Start by reading the disclosure path in qBraid/qBraid's SECURITY.md, then add a SECURITY.md at the root of pyqasm, qbraid-qir and qbraid-algorithms, which currently have none. Each file should name a contact and a response expectation. Secret scanning and push protection are toggled under the repository's Settings, in the code security section. Done means all three repositories have a SECURITY.md and both settings are enabled where they were off.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Problem

Three of the four public OSE repositories have no SECURITY.md, so a researcher who finds a vulnerability in them has no documented private disclosure path. Their only options are a public issue, which discloses the problem to everyone at once, or guessing at an email address.

Repo SECURITY.md Secret scanning
qBraid ✅ ✅ enabled
pyqasm ❌ ❌ disabled
qbraid-qir ❌ ❌ disabled
qbraid-algorithms ❌ ❌ disabled

PyQASM is the sharpest case: it now records more monthly downloads than the qBraid-SDK, so it is the most-installed package in the ecosystem and the one with no way to report a vulnerability privately.

Suggested fix

  1. Add SECURITY.md to pyqasm, qbraid-qir and qbraid-algorithms, pointing at the same disclosure path qBraid/qBraid already uses. A short file naming a contact and a response expectation is enough.
  2. Enable secret scanning and push protection on the three repositories where they are off. Both are settings changes.
  3. Consider enabling private vulnerability reporting so reports arrive through GitHub rather than email.

Why now

Zero security advisories have been published across all four repositories in the project's history. That reflects no reported vulnerabilities rather than a process for handling them, and the first report is a bad time to discover the process does not exist.

Lenguaje dominante
Python
Estrellas
29
Forks
33
Merge medio
2 d 4 h
PR fusionados (30 d)
15

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de qBraid/pyqasm

Todos los issues de qBraid/pyqasm

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.