Skip to content

PRIVATE_VULNERABILITY_REPORTING_STATUS.md

Latest commit

 

History

History
42 lines (31 loc) · 2.29 KB

PRIVATE_VULNERABILITY_REPORTING_STATUS.md

File metadata and controls

42 lines (31 loc) · 2.29 KB
Raw

Private Vulnerability Reporting Status

Private reporting blocker RB-002 is closed. Notification ownership RB-003 and V100-06 are also closed for the current repository state; ownership continuity remains subject to review after relevant changes.

Verified State

  • Repository: Cynrath/agent-context-kit
  • Enabled and independently verified: 2026-06-14
  • Method: authenticated GitHub REST API enablement followed by a separate read-only GET
  • Result: enabled: true
  • Public surface: repository Security page returned HTTP 200 and exposed the private vulnerability report entry point
  • Maintainer: Cynrath
  • RC effect: private-reporting P0 blocker closed; notification ownership complete for the current repository state

Only the boolean status is recorded. Authentication headers, tokens, reporter data, vulnerability details, and private URLs are not stored.

Read-Only Verification

Use the repository script or the underlying GitHub GET endpoint: https://docs.github.com/en/rest/repos/repos#check-if-private-vulnerability-reporting-is-enabled-for-a-repository

powershell -ExecutionPolicy Bypass -File scripts/check-private-vulnerability-reporting.ps1 -RequireEnabled

gh api `
  -H "Accept: application/vnd.github+json" `
  -H "X-GitHub-Api-Version: 2026-03-10" `
  repos/Cynrath/agent-context-kit/private-vulnerability-reporting

Expected response:

{"enabled":true}

Enablement Evidence

TASK-0129 used the authenticated repository endpoint under explicit maintainer authorization. It did not create an advisory, inspect private reports, log authentication data, or change unrelated security settings. A follow-up GET returned enabled: true; the public Security page exposed the report entry point without submitting a test report.

Completion Rule

The private-reporting setting is complete because the exact repository returned enabled: true, the report entry point was visible, and the maintainer/date were recorded. TASK-0202 records primary/backup notification ownership; TASK-0232 freshly verified the setting and backup collaborator permission on 2026-07-10.

Remote Boundary

TASK-0129 changed only the private-reporting boolean. It did not submit a report, create/edit an advisory, read private report content, expose reporter identity, or perform any release action.