Labels: documentation security 200pts
Background:
docs/reference/SECURITY.md mentions vulnerability disclosure but doesn't describe the actual process. Security researchers don't know how to report vulnerabilities, what the response SLA is, or what the bug bounty program looks like.
Problem:
The current SECURITY.md is generic. There is no triage process, no contact method, no response timeline, no scope definition for what qualifies as a vulnerability, and no example of what a good report looks like.
What "Done" Looks Like:
- Complete rewrite of
docs/reference/SECURITY.md
- Scope definition: what IS in scope (contract exploits, auth bypasses, fund theft vectors) and what is NOT (gas optimization, UX issues, theoretical attacks requiring physical access)
- Reporting process: how to submit (encrypted email or GitHub Security Advisory), what to include in the report (description, reproduction steps, impact assessment, suggested fix)
- Response SLA: acknowledgement within 48 hours, triage within 7 days, fix timeline based on severity
- Severity classification table: Critical / High / Medium / Low with examples for each
- Responsible disclosure timeline: what happens after report, when public disclosure is appropriate
- Bug bounty section: scope, reward tiers, payment method (note: bounty program details TBD by maintainers)
Key Files to Reference:
docs/reference/SECURITY.md (current state)docs/CODE_OF_CONDUCT.md.github/ISSUE_TEMPLATE/
Constraints:
- Response SLAs must be realistic (don't promise 24h turnaround if not achievable)
- Severity examples must be VaultDAO-specific (not generic web security examples)
- Must comply with GitHub Security Advisory format
PR Must Include:
- Rewritten
docs/reference/SECURITY.md
- GitHub Security Advisory template
- Severity classification table with VaultDAO-specific examples
Labels:
documentationsecurity200ptsBackground:
docs/reference/SECURITY.mdmentions vulnerability disclosure but doesn't describe the actual process. Security researchers don't know how to report vulnerabilities, what the response SLA is, or what the bug bounty program looks like.Problem:
The current
SECURITY.mdis generic. There is no triage process, no contact method, no response timeline, no scope definition for what qualifies as a vulnerability, and no example of what a good report looks like.What "Done" Looks Like:
docs/reference/SECURITY.mdKey Files to Reference:
docs/reference/SECURITY.md(current state)docs/CODE_OF_CONDUCT.md.github/ISSUE_TEMPLATE/Constraints:
PR Must Include:
docs/reference/SECURITY.md