mirror of
https://github.com/only-cli/oc.git
synced 2026-09-15 10:40:56 +02:00
only-cli
bbe894bb96
Every GitHub action is now pinned to a full commit SHA with its version in a trailing comment, verified against each upstream repo's tags, so a retagged release cannot swap code under CI. The publish workflow pins npm to an exact version instead of @latest, the experiment Dockerfile pins its base image by digest, and codeql.yml gets a top-level read-all permissions block so the default token grants nothing the analyze job does not ask for. SECURITY.md points reports at GitHub private vulnerability reporting, which is now enabled, and scopes out experiments/. Branch protection on main now blocks force pushes and deletions.
25 lines
886 B
Markdown
25 lines
886 B
Markdown
# Security
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Report vulnerabilities privately through GitHub: [Security > Report a
|
|
vulnerability](https://github.com/only-cli/oc/security/advisories/new).
|
|
Please do not open a public issue for anything exploitable.
|
|
|
|
Expect an acknowledgement within a week. Fixes ship as a patch release,
|
|
and the advisory is published once the fix is out.
|
|
|
|
## Scope
|
|
|
|
oc fetches untrusted web pages by design, so the interesting bugs are the
|
|
ones where page content escapes its role as data: rendered text that can
|
|
alter what an agent executes, URLs that reach private or internal hosts
|
|
despite the SSRF guard, or a crafted page that breaks the distiller. Bugs
|
|
in the experiments/ directory are out of scope; nothing there ships in
|
|
the package.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest release on npm is supported. There is no backporting; a
|
|
security fix means a new release.
|