Create SECURITY.md for security policy#483
Open
onetopcon-sys wants to merge 3 commits into
Open
Conversation
* fix: 🐛 minor typo and build process * feat: 🎸 [WIP] Pentest mode * feat: 🎸 code abstraction * feat: modernize legacy PentestGPT with native multi-LLM support (GreyDGL#469) Rebuild the classic USENIX-2024 interactive PentestGPT (reasoning / generation / parsing sessions + Pentesting Task Tree + REPL) as a standalone `pentestgpt_legacy` package on a native per-provider LLM layer that supports the latest 2026 models. - llm/: BaseProvider + OpenAI-compatible / Anthropic / Gemini connectors, a web-verified model registry (OpenAI, Anthropic, Gemini, DeepSeek, xAI, Qwen, Moonshot, local Ollama), a factory, and an LLMClient bridging async providers to the core's synchronous send_new_message/send_message session API. - CLI `pentestgpt-legacy`: --list-models and --smoke-test (live per-model round-trip matrix), plus --reasoning-model / --parsing-model / --base-url. - Tests: 25 unit tests (mocked, no network). Live smoke test verified 22/22 models with a configured key respond. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(backend): address review on ClaudeCodeBackend subprocess handling - _build_env: pop ANTHROPIC_API_KEY instead of setting it to "", so an empty value can't shadow the CLI's own auth fallback (e.g. subscription login). - _kill_process: reap the force-killed process with os.waitpid(.., WNOHANG) instead of calling the proc.wait() coroutine without awaiting it (removes the "coroutine was never awaited" warning). - query/_drain_stderr: drain subprocess stderr in a background task so its pipe buffer can't fill and deadlock the child. Also reformats backend.py, fixing the failing Lint (ruff format) check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(docker-test): assert uv instead of Poetry in container health check The project migrated from Poetry to uv (the Dockerfile installs uv to /home/pentester/.local/bin, which is on PATH), so test_poetry_installed failed with exit 127. Replace it with test_uv_installed checking `uv --version`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Added a security policy document outlining supported versions and vulnerability reporting.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new SECURITY.md file to define the project's security policy. The review feedback correctly identifies that the added file contains placeholder template text and incorrect version numbers, and it provides actionable suggestions to update the supported versions and vulnerability reporting instructions with actual project details.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Comment on lines
+17
to
+21
| Use this section to tell people how to report a vulnerability. | ||
|
|
||
| Tell them where to go, how often they can expect to get an update on a | ||
| reported vulnerability, what to expect if the vulnerability is accepted or | ||
| declined, etc. |
There was a problem hiding this comment.
The "Reporting a Vulnerability" section contains placeholder template instructions. Please replace this text with actual instructions on how to report security vulnerabilities (for example, by emailing the maintainer at GELEI.DENG@ntu.edu.sg or utilizing GitHub's private vulnerability reporting feature).
Suggested change
| Use this section to tell people how to report a vulnerability. | |
| Tell them where to go, how often they can expect to get an update on a | |
| reported vulnerability, what to expect if the vulnerability is accepted or | |
| declined, etc. | |
| To report a security vulnerability, please email the maintainers at GELEI.DENG@ntu.edu.sg. We will acknowledge your report and provide an initial response within 48 hours. |
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added a security policy document outlining supported versions and vulnerability reporting.