SECURITY.md points to private vulnerability reporting, which is disabled on the repository
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- github
- Domain
- documentation, security
Research direction
Start with SECURITY.md and inspect the repository setting reported by gh api repos/theam/facility/private-vulnerability-reporting. Confirm whether private reporting can be enabled; otherwise update the policy with a working security contact or fallback. Done means a non-maintainer following the documented process has a usable way to submit an in-scope vulnerability.
Written by the indexing model from the issue text.
Description
SECURITY.md asks for private reports via https://github.com/theam/facility/security/advisories/new and explicitly says not to open public issues for suspected vulnerabilities — but private vulnerability reporting is not enabled on this repository:
$ gh api repos/theam/facility/private-vulnerability-reporting
{"enabled":false}
So a non-maintainer who follows the policy lands on a page that cannot submit anything, and has no fallback address. I hit this tonight with something that is in scope per the policy (a generated workflow that lets review text from a non-collaborator drive an agent with push rights). I am holding it back rather than posting it here; a security contact (email or the toggle in Settings → Code security → Private vulnerability reporting) would let me send it.
- Dominant language
- TypeScript
- Stars
- 71
- Forks
- 64
- Avg merge
- 15h 38m
- Merged PRs (30d)
- 66
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from theam/facility
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
enhancement
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100