LibreKAT/Ocideck

Watch

Fork 0

fix: stuur kwetsbaarheidsmeldingen naar het adres dat we zelf documenteren #523

Merged

brenno merged 2 commits from fix/meldadres-consistentie into main

2026-07-22 10:12:53 +00:00

brenno commented

2026-07-22 10:12:46 +00:00

Owner

Summary

.github/ISSUE_TEMPLATE/config.yml sent security reports to security@vigilis.nl, while SECURITY.md and CODE_OF_CONDUCT.md both name security@librekat.nl. Anyone following the tracker's own "report privately" link mailed an address the project does not document — on the one path a vulnerability reporter actually walks.

Closes #507

Changes

test/security_contact_consistency_test.dart — compares every security@ address in the READMEs, the code of conduct, CONTRIBUTING and all four GitHub templates against the one in SECURITY.md. A second assertion pins the canonical address to the foundation domain, so the mismatch cannot be "fixed" by dragging SECURITY.md to the wrong address instead.
.github/ISSUE_TEMPLATE/config.yml — corrected to security@librekat.nl.
CHANGELOG entry under Fixed.

The two commits are deliberately split: the test commit stands red on its own (verified by checking it out and running it), the fix commit turns it green. The guard was also verified against a planted regression.

Gates

make check — green (86.2% line coverage, per-file floor 0 below budget).
make check-secrets — red, pre-existing. trufflehog flags .git/logs/HEAD, the local reflog, as a LokaliseToken; both gitleaks passes report no leaks. Filed as #522. Not caused by this branch.
make sast — red, pre-existing. semgrep.ocideck-subproces-buiten-de-gitlaag fires on lib/services/disk_traces.dart:257, which is on main and untouched here. Filed as #521.

Principles

Touches a public promise (where to report a vulnerability), so weighed against the project's principles: this moves the promise towards what the documentation already says rather than adding a new one, and puts the contact on a domain the foundation controls. No conflict to record.

## Summary `.github/ISSUE_TEMPLATE/config.yml` sent security reports to `security@vigilis.nl`, while `SECURITY.md` and `CODE_OF_CONDUCT.md` both name `security@librekat.nl`. Anyone following the tracker's own "report privately" link mailed an address the project does not document — on the one path a vulnerability reporter actually walks. Closes #507 ## Changes - `test/security_contact_consistency_test.dart` — compares every `security@` address in the READMEs, the code of conduct, `CONTRIBUTING` and all four GitHub templates against the one in `SECURITY.md`. A second assertion pins the canonical address to the foundation domain, so the mismatch cannot be "fixed" by dragging `SECURITY.md` to the wrong address instead. - `.github/ISSUE_TEMPLATE/config.yml` — corrected to `security@librekat.nl`. - CHANGELOG entry under Fixed. The two commits are deliberately split: the test commit stands **red** on its own (verified by checking it out and running it), the fix commit turns it green. The guard was also verified against a planted regression. ## Gates - `make check` — green (86.2% line coverage, per-file floor 0 below budget). - `make check-secrets` — **red, pre-existing.** trufflehog flags `.git/logs/HEAD`, the local reflog, as a `LokaliseToken`; both gitleaks passes report no leaks. Filed as #522. Not caused by this branch. - `make sast` — **red, pre-existing.** `semgrep.ocideck-subproces-buiten-de-gitlaag` fires on `lib/services/disk_traces.dart:257`, which is on `main` and untouched here. Filed as #521. ## Principles Touches a public promise (where to report a vulnerability), so weighed against the project's principles: this moves the promise *towards* what the documentation already says rather than adding a new one, and puts the contact on a domain the foundation controls. No conflict to record.

brenno added 2 commits

2026-07-22 10:12:46 +00:00

test(meldadres): bewaak dat elk contactadres met SECURITY.md overeenkomt 4163bc2d02

De drie plekken die een melder de weg wijzen konden ongemerkt uit elkaar
lopen. SECURITY.md is hier de bron van waarheid, want daar verwijzen de
tracker, de README en de sjablonen allemaal naar.

Deze commit staat bewust rood: config.yml wijst nog naar het oude adres.
De tweede assertie vangt de omgekeerde reparatie af — wie het verschil
oplost door SECURITY.md te verslepen, krijgt de eerste test groen om de
verkeerde reden.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix(meldadres): stuur kwetsbaarheidsmeldingen naar security@librekat.nl

CI / Gate (Linux) · Format · Analyze · Coverage (push) Has been cancelled

Details

CI / Test (macos-latest) (push) Has been cancelled

Details

CI / Test (windows-latest) (push) Has been cancelled

Details

CI / Web hardening (push) Has been cancelled

Details

CI / Docs links (push) Has been cancelled

Details

CI / Supply-chain (Trivy · advisory) (push) Has been cancelled

Details

CI / Gate (Linux) · Format · Analyze · Coverage (pull_request) Has been cancelled

Details

CI / Test (macos-latest) (pull_request) Has been cancelled

Details

CI / Test (windows-latest) (pull_request) Has been cancelled

Details

CI / Web hardening (pull_request) Has been cancelled

Details

CI / Docs links (pull_request) Has been cancelled

Details

CI / Supply-chain (Trivy · advisory) (pull_request) Has been cancelled

Details

7c76626c16

Het contactkaartje in de tracker verwees naar security@vigilis.nl. Wie de
route volgde die we zelf aanwijzen, mailde een adres dat in onze eigen
documentatie niet voorkomt.

Closes #507

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

brenno merged commit bba7224e6f into main

2026-07-22 10:12:53 +00:00

brenno deleted branch fix/meldadres-consistentie

2026-07-22 10:12:54 +00:00

brenno referenced this pull request from a commit

2026-07-22 10:12:55 +00:00

Merge pull request 'fix: stuur kwetsbaarheidsmeldingen naar het adres dat we zelf documenteren' (#523) from fix/meldadres-consistentie into main