[devantler]

Why

The organization's default security policy explains how to report a vulnerability privately, but not what happens afterwards. Reporters cannot tell when they will hear back, when the issue becomes public, or whether they will be credited. Private vulnerability reports are now arriving through GitHub's report form, so the follow-up should be stated.

What

.github/SECURITY.md gains:

• What a useful report contains, and to test only against your own installations.
• What happens next:
  • acknowledgement within three business days, and an assessment within seven days;
  • fix targets of 14 days for critical and high, and 90 days for others;
  • coordinated disclosure through a GitHub security advisory, with a CVE where one applies, after a fixed release;
  • credit for the reporter;
  • how reports are handled: triaged with AI agents under the maintainer's supervision, and a proof of concept is never run.
• Out of scope: third-party dependencies, issues that need a compromised machine, and unverified scanner output.

The existing reporting instructions are unchanged. Repositories with their own SECURITY.md, such as KSail, keep theirs.

For the maintainer: these response targets become a public commitment. Adjust the numbers before merging if they don't fit.

🤖 Generated with Claude Code

[github-code-quality]

Code coverage overview

Languages: Go, C#

Go / code-coverage/test

main 945434b	claude/security-poli... bdb5b2e	+/-
50%	50%	0%

C# / code-coverage/dotnet

main 945434b	claude/security-poli... bdb5b2e	+/-
100%	100%	0%

Go / code-coverage/go

main 945434b	claude/security-poli... bdb5b2e	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 17, 2026 20:50 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T22:53:36.101069Z	bdb5b2e	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: bdb5b2efb9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at bdb5b2efb9c653b199ce3b5cc1ae0454397e9fd6:

• All 279 exact-head check runs are terminal: 215 successful and 64 skipped; the remaining commit status is successful. The required check and four readable workflow gates pass. GitHub reports CLEAN; its configured native code-quality rule has no independently readable head result, so I am relying on GitHub's merge enforcement for that rule.
• Codex's substantive clean receipt 6242619878 names this head. Complete conversation, review-object and review-thread reads contain no unresolved findings or human control comments.
• I read the complete reporter-facing policy and all 25 added lines as a reporter: the affected repository's private reporting route remains clear, reproduction stays on the reporter's own installation, response targets and disclosure/credit expectations are stated, and proof-of-concept code is not executed. This is static Markdown with no exercisable runtime surface; the consumer is GitHub's default community-health policy, with repository-specific policies taking precedence. No live vulnerability report was submitted.
• Current main has two independent commits since the branch point. I inspected their changed-path list: neither changes this policy, and the PR remains mergeable. The branch publication is outside the activity window, the review has completed, and the local holder check reports none.

The draft is ready for promotion and the ordinary head-pinned merge path.

[devantler]

🤖 Generated by the Agentic Engineer

Post-merge verification is complete for 1d05d53865ef7546d5ce1c2f65c8a34bc717d6d5.

• CI, release, CodeQL, and code quality all completed successfully on that exact merge commit.
• The published default-branch security policy has the same Git blob as the reviewed PR: 84965ce3791900da262768cb73cd1d75b828ced1. I read the complete policy on current main and confirmed the private reporting route, response targets, coordinated disclosure and reporter credit are present.

This closes the pending post-merge collection. No vulnerability report was submitted; response-time performance will need evidence from actual private reports.