[PR #19] [MERGED] docs: add SECURITY.md vulnerability disclosure policy #21

New issue

Closed

opened 2026-10-26 22:34:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:34:02 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/comfy-swift-sdk/pull/19
Author: @mattmillerai
Created: 6/21/2026
Status: ✅ Merged
Merged: 6/21/2026
Merged by: @mattmillerai

Base: main ← Head: chore/security-policy

📝 Commits (1)

a3ac937 docs: add SECURITY.md vulnerability disclosure policy

📊 Changes

1 file changed (+44 additions, -0 deletions)

View changed files

➕ SECURITY.md (+44 -0)

📄 Description

Adds a SECURITY.md ahead of the public launch.

Points reporters at GitHub private vulnerability reporting (no public issue for vulns)
Scopes what's relevant to a thin client: credential handling, transport/TLS, OAuth/PKCE
Pre-1.0 supported-versions note; backend is out of scope (routed via the same channel)

Note: the "Report a vulnerability" link only goes live once the repo is public and private vulnerability reporting is enabled in repo Settings → Security (the API to enable it 404s while the repo is private).

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/comfy-swift-sdk/pull/19 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 6/21/2026 **Status:** ✅ Merged **Merged:** 6/21/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `chore/security-policy` --- ### 📝 Commits (1) - [`a3ac937`](https://github.com/Comfy-Org/comfy-swift-sdk/commit/a3ac937e03895f619074db244cd1e0e48c86ef7f) docs: add SECURITY.md vulnerability disclosure policy ### 📊 Changes **1 file changed** (+44 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `SECURITY.md` (+44 -0) </details> ### 📄 Description Adds a `SECURITY.md` ahead of the public launch. - Points reporters at GitHub **private vulnerability reporting** (no public issue for vulns) - Scopes what's relevant to a thin client: credential handling, transport/TLS, OAuth/PKCE - Pre-1.0 supported-versions note; backend is out of scope (routed via the same channel) Note: the "Report a vulnerability" link only goes live once the repo is public **and** private vulnerability reporting is enabled in repo Settings → Security (the API to enable it 404s while the repo is private). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:34:02 +00:00