Update SECURITY-INSIGHTS #1111
Update SECURITY-INSIGHTS #1111
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughEdits to .github/SECURITY-INSIGHTS.yml: removed two header comments; replaced repository.core-team with a top-level list of six members; updated documentation.security-policy URL to SECURITY.md; adjusted several comment strings (assessments, Dependabot, Snyk); and removed the Socket tool entry from repository.security.tools. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/SECURITY-INSIGHTS.yml (2)
17-41: Core team entries look consistent; confirm public PII exposure is intended.Member list, fields, and booleans look fine. Please confirm all listed emails are okay to publish in a public repo (spam/PII risk). If not, prefer a shared/security mailing list alias.
59-59: Fix typo and naming: “join” → “joint”; “TAG-Security” → “TAG Security”.Use the canonical CNCF TAG name and correct grammar.
Apply:
- comment: OpenFGA has completed a CNCF security join assessment with CNCF TAG-Security + comment: OpenFGA has completed a CNCF security joint assessment with CNCF TAG Security
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/SECURITY-INSIGHTS.yml(4 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: deploy-preview
- GitHub Check: Test deployment
- GitHub Check: markdown-link-check-md
- GitHub Check: Run Checks
🔇 Additional comments (2)
.github/SECURITY-INSIGHTS.yml (2)
71-71: LGTM: clearer Dependabot comment.
81-81: LGTM: clearer Snyk comment.
| governance: https://github.com/openfga/.github/blob/main/GOVERNANCE.md | ||
| review-policy: https://github.com/openfga/.github/blob/main/CONTRIBUTING.md | ||
| security-policy: https://github.com/openfga/openfga.dev/security.md | ||
| security-policy: https://github.com/openfga/openfga.dev/SECURITY.md |
There was a problem hiding this comment.
🧩 Analysis chain
Verify SECURITY.md path exists on main.
Link casing changed; likely correct. Please verify the file exists.
Run:
Also consider updating header.last-updated/last-reviewed to 2025-09-18 to reflect this change.
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for url in \
https://raw.githubusercontent.com/openfga/openfga.dev/main/SECURITY.md \
https://raw.githubusercontent.com/openfga/openfga.dev/main/security.md
do
code=$(curl -sI "$url" | awk 'NR==1{print $2}')
echo "$code $url"
doneLength of output: 151
Fix broken security-policy link (SECURITY.md missing on main)
Verification: both checked URLs returned 404:
- https://raw.githubusercontent.com/openfga/openfga.dev/main/SECURITY.md
- https://raw.githubusercontent.com/openfga/openfga.dev/main/security.md
Actions:
- Add SECURITY.md to the repo root on main OR update .github/SECURITY-INSIGHTS.yml (line 52) to point to the correct security-policy URL/path.
- Set header.last-updated / last-reviewed to 2025-09-18 after the change.
🤖 Prompt for AI Agents
.github/SECURITY-INSIGHTS.yml around line 52: the security-policy URL points to
https://github.com/openfga/openfga.dev/SECURITY.md which 404s on main; fix by
either adding a SECURITY.md file to the repo root on main or updating the
security-policy value to the correct existing path/URL (e.g., point to the
lowercase security.md or the raw URL that works), and after making that change
set header.last-updated and header.last-reviewed to 2025-09-18.
Automated update of SECURITY-INSIGHTS.yml file
Summary by CodeRabbit
Documentation
Chores