From 20d3c8cd0e4f78ccc2d871e0051f785250b4aa74 Mon Sep 17 00:00:00 2001 From: ccp_cortege <194108214+CCP-Cortege@users.noreply.github.com> Date: Thu, 13 Aug 2026 14:50:26 +0000 Subject: [PATCH 1/2] Update bug report template for clarity and details --- .github/ISSUE_TEMPLATE/bug_report.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index ab25703..e982d71 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -1,9 +1,19 @@ + + name: "Bug Report" description: "Report a reproducible problem in this repository. Incomplete reports make it hard to reproduce issues and may be closed." title: "[Bug] " labels: [bug] body: + + - type: markdown + attributes: + value: | + > ⚠️ **Found a security issue? Do not file it here.** + > Do not open a public issue for security vulnerabilities. See our + > [Security Policy](https://github.com/carbonengine/.github/blob/main/SECURITY.md) + > for how to report privately. - type: markdown attributes: value: | @@ -32,6 +42,7 @@ body: options: - Windows 10/11 - macOS + - Other default: 0 validations: required: true @@ -42,8 +53,8 @@ body: label: "Tool-chain details" description: | Compiler / interpreter versions, build system, etc. - Example: MSVC 19.38 · CMake 3.28 · Python 3.11.3 - placeholder: "clang 16, Ninja 1.11, Python 3.10.7" + Example: MSVC v141 · CMake 3.31 · Python 3.11.3 + placeholder: "MSVC v141, CMake 3.31, Python 3.11.3" validations: required: true From 4e68980d636ed146a807d1ec7e7ae9a368a76ebb Mon Sep 17 00:00:00 2001 From: ccp_cortege <194108214+CCP-Cortege@users.noreply.github.com> Date: Thu, 10 Sep 2026 11:48:11 +0000 Subject: [PATCH 2/2] Revise security policy and reporting instructions Updated the security policy to change reporting procedures and added details on GitHub's private vulnerability reporting. --- SECURITY.md | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 5f16028..4a5dd30 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,5 @@ # Security Policy -As CARBON, we take security seriously. This page explains **how to report vulnerabilities privately**, what’s **in scope** for the open-source code we publish on GitHub, and **what you can expect from us**. +Carbon Engine takes security seriously. This page explains **how to report vulnerabilities privately**, what’s **in scope** for the open-source code we publish on GitHub, and **what you can expect from us**. --- ## Scope @@ -8,17 +8,25 @@ It does **not** cover FC’s production game services or player accounts (EVE On --- ## How to Report -- **Please DO NOT open a public issue for security problems.** - Email **security@fenris.com** with the subject line: - `Vulnerability Report: ` -Include as much detail as you can: -- Commit hash or release tag -- Steps to reproduce (from a clean clone) -- Technical details (logs, requests/responses, payloads) -- Impact (what an attacker could achieve) -- Environment (OS, compiler/interpreter, build system) -- Your contact info and whether you prefer to remain anonymous -If you’re unsure whether something qualifies as a security issue, **send it anyway** and we’ll help triage. +**Please DO NOT open a public issue for security problems.** + +Report vulnerabilities through **GitHub private vulnerability reporting**: +- On the affected repository: + - Open the **Security** tab and click **Report a vulnerability**. + - This opens a private advisory only the maintainers can see, and keeps the report, +discussion, and fix coordination in one private place. + - For a step-by-step walkthrough of GitHub's private reporting flow, see [Privately reporting a security vulnerability](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately). + + +In your advisory **Description**, please include as much detail as you can, e.g.: + - Commit hash or release tag + - Steps to reproduce (from a clean clone) + - Technical details (logs, requests/responses, payloads) + - Impact (what an attacker could achieve) + - Environment (OS, compiler/interpreter, build system) + - Your contact info and whether you prefer to remain anonymous + + If you're unsure whether something qualifies as a security issue, **send it anyway** and we'll help triage. ### AI-generated reports. We **do not** accept vulnerability reports that appear to be unverified AI output, generic "potential" issues without a working reproduction. AI tools are fine for analysis however, the report itself must come from a human who has verified the issue, can reproduce it from a clean clone, and can discuss it. Reports that fail this bar will be closed without detailed triage. @@ -55,6 +63,6 @@ When a fix is ready, we will: - Coordinate public disclosure timing with the reporter --- ## Contact -- **Primary:** security@fenris.com -- **Back-up (non-sensitive questions):** open an Issue in the relevant repo -Thank you for helping keep Carbon (and the developers who depend on it) safe. +- **Report a vulnerability:** GitHub **Security** tab → **Report a vulnerability** on the affected repo +- **Back-up contact (follow-up, coordination, off-platform comms):** security@fenris.com +- **Non-sensitive questions:** open an Issue in the relevant repo