From aabf7b1075eaf27953dc4f4d0c46b8878b0cd259 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Tue, 1 Sep 2026 05:20:08 -0400 Subject: [PATCH 1/3] Route vulnerability disclosure to security@simtabi.com opensource@simtabi.com is the community address; security@simtabi.com is the dedicated disclosure inbox per the org convention, kept separate so a report is never buried in a feature-request thread. --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 1909044..9ac8a34 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## Reporting a vulnerability -Please report security vulnerabilities privately to **opensource@simtabi.com**. +Please report security vulnerabilities privately to **security@simtabi.com**. Do **not** open a public issue for a security report. Include, where possible: a description of the issue, affected version(s), From 70de79fcce6644c28f5a9d3fb8ae603b4a5c9486 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 28 Sep 2026 21:07:17 -0400 Subject: [PATCH 2/3] Name private vulnerability reporting; keep design notes out of the repository Private vulnerability reporting is enabled on this repository, so it is the preferred channel, with security@simtabi.com as the fallback. --- SECURITY.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 9ac8a34..4882055 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,6 +2,8 @@ ## Reporting a vulnerability +The preferred channel is GitHub private vulnerability reporting: open a private report at . The report stays attached to the repository, with a draft advisory and a CVE request path. Email **security@simtabi.com** if you do not use GitHub. + Please report security vulnerabilities privately to **security@simtabi.com**. Do **not** open a public issue for a security report. From cf3bce44f0bc7acede5fff776a7fdf44235edca7 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 28 Sep 2026 21:20:45 -0400 Subject: [PATCH 3/3] Take CI's Go version from src/go.mod, not stable stable moved to Go 1.27 while the pinned golangci-lint is built with 1.26, which panics: "file requires newer Go version go1.27". release.yml and codeql.yml already read src/go.mod. --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 50b7b40..9de05e2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,7 +38,9 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: stable + # The module declares its toolchain; `stable` moved to 1.27 under a + # golangci-lint built with 1.26, which panics on the newer stdlib. + go-version-file: src/go.mod # One gate, defined once, in the Makefile. Reimplementing these steps here # let the local `make check` and CI drift apart silently. - name: Gate