From 59e38c3fc9d60d0c459c3ab86a6985d10b6f728e Mon Sep 17 00:00:00 2001 From: anhnh2002 Date: Thu, 10 Sep 2026 17:56:28 +0700 Subject: [PATCH] Add SECURITY.md and LICENSE Adds a security policy pointing reporters at GitHub private vulnerability reporting, with response-time commitments and an explicit scope for a tool that analyzes untrusted repositories and drives local agent CLIs. Adds the MIT LICENSE file that README.md and pyproject.toml already declare, so GitHub detects the license and the README badge link resolves. Addresses #104. --- LICENSE | 21 +++++++++++++++++ SECURITY.md | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 89 insertions(+) create mode 100644 LICENSE create mode 100644 SECURITY.md diff --git a/LICENSE b/LICENSE new file mode 100644 index 00000000..b40b65c4 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2025 FSoft-AI4Code + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..6d182bde --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,68 @@ +# Security Policy + +## Reporting a vulnerability + +Please do not report security issues through public GitHub issues, pull +requests, or discussions. + +Use GitHub's private vulnerability reporting instead: + +**https://github.com/FSoft-AI4Code/CodeWiki/security/advisories/new** + +This opens a private thread that only the CodeWiki maintainers can see. You do +not need to be a collaborator on the repository to use it. + +When reporting, please include as much of the following as you can: + +- The version or commit of CodeWiki you tested against +- The command line or configuration you used (redact any API keys) +- Steps to reproduce, or a minimal repository that triggers the issue +- What an attacker can achieve, and under which conditions +- Any suggested fix, if you have one + +## What to expect + +- We will acknowledge your report within **5 business days**. +- We will keep you informed as we confirm the issue and work on a fix. +- We aim to publish a fix and a GitHub Security Advisory within **90 days** of + the initial report. If we need more time, we will tell you why and agree on + a new date with you. +- We will credit you in the advisory unless you ask us not to. + +## Supported versions + +Security fixes are applied to the `main` branch and to the most recent +release. Older versions are not maintained. + +## Scope + +CodeWiki clones or reads repositories that you point it at. In subscription +mode it routes LLM calls through the local `claude` or `codex` CLI, and in +IDE-driven mode it runs as an MCP server driven by an AI IDE agent on your +machine. The trust boundary we care about most is the boundary between the +analyzed repository and the rest of your system. + +In scope: + +- Any way for content inside an analyzed repository (source files, READMEs, + configuration, file names) to cause CodeWiki or the agent it drives to read + or write files outside the intended output directory, execute commands, or + exfiltrate data such as API keys +- Path traversal, command injection, or unsafe deserialization in CodeWiki + itself +- Leakage of credentials, tokens, or environment variables into generated + documentation or logs +- Vulnerabilities in the Docker images or the web viewer shipped in this + repository + +Out of scope: + +- Inaccurate, incomplete, or hallucinated documentation content +- Vulnerabilities in the underlying LLM providers or agent CLIs (Claude Code, + Codex CLI, and others). Please report those upstream. +- Issues that require the attacker to already control the machine running + CodeWiki +- Findings from automated scanners without a demonstrated impact + +If you are unsure whether something is in scope, report it privately anyway +and we will work it out together.