Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Removed SECURITY.md #38

Merged
merged 2 commits into from
Oct 4, 2024
Merged

Conversation

vaughnw128
Copy link
Contributor

This PR is to remove the SECURITY.md file from the repository, as SECURITY.md files are centrally managed in the organization's .github repository. This allows for easy updates made by security in the future.

Copy link
Contributor

@jsumners-nr jsumners-nr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please update references:

As noted in our [security policy](./SECURITY.md), New Relic is committed to the privacy and security of our customers and their data. We believe that providing coordinated disclosure by security researchers and engaging with the security community are important means to achieve our security goals.

@vaughnw128
Copy link
Contributor Author

Hi @jsumners-nr, I've updated the reference to link to the security policy tab in the repository. Once the PR is merged that security policy page will be replaced with the SECURITY.md located in .github. Thanks!

@jsumners-nr jsumners-nr merged commit 2172e3b into newrelic:main Oct 4, 2024
5 checks passed
@bizob2828
Copy link
Member

This repo was created from a template. Was that updated to avoid this in the future?

@vaughnw128
Copy link
Contributor Author

@bizob2828 It doesn't look like the template has a SECURITY.md present, so it should be alright: https://github.com/newrelic/newrelic-repo-template

An issue could arise if devs add the SECURITY.md themselves, but I think with Github making the security policy more visible in the README section that's unlikely. One less file in the root level of the repo!

@bizob2828
Copy link
Member

ok yea i see the template has the right link. We've also had a violation #25 which I'll close

@bizob2828
Copy link
Member

Something is up with repolinter #39

@vaughnw128
Copy link
Contributor Author

Something is up with repolinter #39

It looks like there's an issue with the repolinter's match on finding the security policy. It's looking for newrelic-experimental

https://github.com/newrelic/.github/blob/main/repolinter-rulesets/new-relic-experimental.yml#L82

@bizob2828
Copy link
Member

it expected URL to be in the newrelic-experimental org https:\/\/github\.com\/newrelic-experimental\/[^\/]+)|(?:\.\.\/\.\.))\/security\/policy

@vaughnw128
Copy link
Contributor Author

it expected URL to be in the newrelic-experimental org https:\/\/github\.com\/newrelic-experimental\/[^\/]+)|(?:\.\.\/\.\.))\/security\/policy

I think this is due to the fact that this repo is considered 'experimental.' The problem is that we can't change the underlying repolinter ruleset as it's being referenced in every single newrelic-experimental repository. We may want to create a repolinter ruleset that is specific to experimental repos in the newrelic organization.

@bizob2828
Copy link
Member

I just moved to community project. we do maintain this. it's used internally and I don't feel like moving to the experimental org

@vaughnw128
Copy link
Contributor Author

Yeah, moving to experimental would be a bit of a waste of time. Thanks for fixing that up!

@mrickard
Copy link
Member

mrickard commented Oct 4, 2024

@vaughnw128 It looks like repolinter is still having some problems in #41 . Would that require a change here or in repolinter?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done: Issues recently completed
Development

Successfully merging this pull request may close these issues.

4 participants