Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Add SECURITY.md and enable secret scanning (missing on 3 of 4 OSE repos)

Aperta
  • Qualcosa non va?
#382 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
50/100
Tipo di issue
Documentazione
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
github, markdown
Ambito
documentation, security

Direzione di ricerca

Start by reading the disclosure path in qBraid/qBraid's SECURITY.md, then add a SECURITY.md at the root of pyqasm, qbraid-qir and qbraid-algorithms, which currently have none. Each file should name a contact and a response expectation. Secret scanning and push protection are toggled under the repository's Settings, in the code security section. Done means all three repositories have a SECURITY.md and both settings are enabled where they were off.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

Three of the four public OSE repositories have no SECURITY.md, so a researcher who finds a vulnerability in them has no documented private disclosure path. Their only options are a public issue, which discloses the problem to everyone at once, or guessing at an email address.

Repo SECURITY.md Secret scanning
qBraid ✅ ✅ enabled
pyqasm ❌ ❌ disabled
qbraid-qir ❌ ❌ disabled
qbraid-algorithms ❌ ❌ disabled

PyQASM is the sharpest case: it now records more monthly downloads than the qBraid-SDK, so it is the most-installed package in the ecosystem and the one with no way to report a vulnerability privately.

Suggested fix

  1. Add SECURITY.md to pyqasm, qbraid-qir and qbraid-algorithms, pointing at the same disclosure path qBraid/qBraid already uses. A short file naming a contact and a response expectation is enough.
  2. Enable secret scanning and push protection on the three repositories where they are off. Both are settings changes.
  3. Consider enabling private vulnerability reporting so reports arrive through GitHub rather than email.

Why now

Zero security advisories have been published across all four repositories in the project's history. That reflects no reported vulnerabilities rather than a process for handling them, and the first report is a bad time to discover the process does not exist.

Lingua principale
Python
Stelle
29
Fork
33
Merge medio
2g 4h
PR unite (30g)
15

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di qBraid/pyqasm

Tutte le issue di qBraid/pyqasm

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.