Add SECURITY.md (draft from 2026-10-04) #57
Description
Context
SECURITY.md was drafted on 2026-10-04 (narrow scope, email reporting channel, standard SLA). The draft is in that session's chat artifact.
Work
- Retrieve the draft and fill in the reporting email address.
- Commit on a branch, open a PR and merge (same workflow as te-csv-migration PR BUG-044: test_ci_quality_gate expects windows-postgres CI job that does not exist #13).
Done when
SECURITY.md is on main.
Activity
amar-python commentedon Oct 25, 2026
Automated verification: FAIL (verify_issues.py, 2026-10-25)
SECURITY.md is not on main.
Generated by Claude Code
docs(security): add placeholder reporting address (part of #57)
Merge pull request #79 from amar-python/docs/security-md
amar-python commentedon Nov 3, 2026
Reopening 3 Nov 2026
PR #79 merged with
singhofoz@gmail.comas a placeholder address — a Gmail that works as a working inbox so SECURITY.md can land on main. The HTML TODO comment in the file itself notes it's a placeholder:<!-- TODO 2026-11-03: this is a Gmail placeholder; replace with security@<org> once the dedicated address exists. Tracked in #57. -->GitHub auto-closed this issue from PR #79's body keyword. Reopening because the issue's actual completion criterion — a dedicated organisation security-reporting address exists and is reflected in SECURITY.md — is not yet met.
Still needed
security@<org>once your org domain supports itsinghofoz@gmail.comand the TODO comment inSECURITY.mdwith the new address, as a small follow-up PRDone when
SECURITY.mdon main shows the dedicated orgsecurity@address (no HTML TODO comment, no personal Gmail)No action needed on this issue until the dedicated domain is set up on your side.
amar-python commentedon Nov 3, 2026
Reopening 3 Nov 2026
PR #79 merged with
singhofoz@gmail.comas a placeholder address — a Gmail that works as a working inbox so SECURITY.md can land on main. The HTML TODO comment in the file itself notes it's a placeholder:<!-- TODO 2026-11-03: this is a Gmail placeholder; replace with security@<org> once the dedicated address exists. Tracked in #57. -->GitHub auto-closed this issue from PR #79's body keyword. Reopening because the issue's actual completion criterion — a dedicated organisation security-reporting address exists and is reflected in SECURITY.md — is not yet met.
Still needed
security@<org>once your org domain supports itsinghofoz@gmail.comand the TODO comment inSECURITY.mdwith the new address, as a small follow-up PRDone when
SECURITY.mdon main shows the dedicated orgsecurity@address (no HTML TODO comment, no personal Gmail)No action needed on this issue until the dedicated domain is set up on your side.