Repository navigation
No SECURITY.md: the published security policy is unreachable from the repo #9881
Description
Summary
T3 Code has a real, well-written security policy — apps/marketing/src/pages/security-policy.astro, published at /security-policy, with a reporting address ([email protected]), stated acknowledgement targets, and an explicit safe harbor for good-faith research.
None of that is reachable from this repository. A researcher who lands on github.com/pingdotgg/t3code finds no pointer to it.
Details
GitHub surfaces a repo's security policy — the "Security" tab, and the Report a vulnerability affordance — from exactly three paths. All three are absent:
| path | present |
|---|---|
SECURITY.md |
no |
.github/SECURITY.md |
no |
docs/SECURITY.md |
no |
There is also no .well-known/security.txt on the marketing site, and no occurrence of [email protected] anywhere in the repo:
$ grep -rn "[email protected]" --include='*.md' --include='*.yml' .
(no matches)
The policy page itself is linked only from the site's own footer, /legal, and the Terms of Service — all on the marketing site, none from the repo.
CONTRIBUTING.md is the natural fallback a reporter would read, and it says "You can still report a bug or open a PR, but please do so knowing there is a high chance we close it, defer it forever, or never look at it." For someone holding a security finding, that reads as "the public issue tracker is the only channel and it may be ignored" — which is the opposite of what your policy actually offers them.
Impact
The gap is discovery, not policy. Someone who finds a vulnerability is most likely to be reading the source, so the repo is where they will look for the channel. Without a pointer, the paths of least resistance become a public issue or a public discussion — the outcome the policy's own "please do not disclose the issue publicly" clause is written to prevent.
Suggested fix
A short .github/SECURITY.md pointing at the canonical policy would close it:
# Security Policy
Please report security vulnerabilities to [email protected] — not via
public issues or discussions.
Full policy, including scope and safe harbor for good-faith research:
https://t3.codes/security-policyThat alone lights up the Security tab and the "Report a vulnerability" button. A .well-known/security.txt on the marketing site would cover the automated-scanner path too.
Related, smaller
docs/internals/t3-code-connect-auth-flow.html contains the substantive security thinking for T3 Connect — "Security Invariant", "Authentication and Transport Matrix", "Credential Ownership", "SSRF and Tunnel Hardening", "Standards References". It is linked from docs/internals/t3-connect.md and infra/relay/README.md, so it is not hidden exactly, but it is the only raw .html file in a docs tree that is otherwise Markdown, and nothing from the README or the security policy points to it. If any part of it is meant as a public statement of the threat model, it is currently addressed only to people already reading relay internals.
Noting CONTRIBUTING.md routes proposals to Ideas Discussions — happy to move this there if you would rather. Filing it here because it concerns the vulnerability-reporting channel itself.
Activity