docs: add SECURITY.md + Code of Conduct; route issue reports to a private channel
- SECURITY.md: GitHub Private Vulnerability Reporting (preferred) + security@codename-11.dev fallback; scope, response expectations, safe harbor. - CODE_OF_CONDUCT.md: Contributor Covenant 2.1 (conduct@codename-11.dev), adopted by reference. - Issue config: replace the public "security guidance" link with a private "Report a vulnerability" link. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Bailey Dixon
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
9f568e12cb
commit
a22bdd9488
@@ -1,8 +1,8 @@
|
||||
blank_issues_enabled: true
|
||||
contact_links:
|
||||
- name: Security guidance
|
||||
url: https://github.com/Codename-11/hermes-relay/blob/main/docs/security.md
|
||||
about: Review the security model before posting sensitive vulnerability details publicly.
|
||||
- name: Report a security vulnerability (private)
|
||||
url: https://github.com/Codename-11/hermes-relay/security/advisories/new
|
||||
about: Report privately via GitHub Security Advisories — do not open a public issue. See SECURITY.md for the full policy.
|
||||
- name: User documentation
|
||||
url: https://codename-11.github.io/hermes-relay/
|
||||
about: Read setup, pairing, remote access, and troubleshooting docs.
|
||||
|
||||
@@ -0,0 +1,78 @@
|
||||
# Code of Conduct
|
||||
|
||||
Hermes-Relay adopts the [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/),
|
||||
version 2.1, as its code of conduct. The canonical, full text lives at that
|
||||
link; the summary below states what it means for this project.
|
||||
|
||||
## Our Pledge
|
||||
|
||||
We as members, contributors, and maintainers pledge to make participation in our
|
||||
community a harassment-free experience for everyone, regardless of age, body
|
||||
size, visible or invisible disability, ethnicity, sex characteristics, gender
|
||||
identity and expression, level of experience, education, socio-economic status,
|
||||
nationality, personal appearance, race, religion, or sexual identity and
|
||||
orientation.
|
||||
|
||||
We pledge to act and interact in ways that contribute to an open, welcoming,
|
||||
diverse, inclusive, and healthy community.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Behavior that helps create a positive environment includes:
|
||||
|
||||
- Showing empathy and kindness toward others.
|
||||
- Being respectful of differing opinions, viewpoints, and experiences.
|
||||
- Giving and gracefully accepting constructive feedback.
|
||||
- Taking responsibility, apologizing to those affected by our mistakes, and
|
||||
learning from the experience.
|
||||
- Focusing on what is best for the overall community, not just ourselves.
|
||||
|
||||
Behavior that is not acceptable includes:
|
||||
|
||||
- Harassment, intimidation, or discrimination in any form.
|
||||
- Personal or political attacks, insults, or derogatory comments.
|
||||
- Unwelcome advances or attention, including of a romantic or sexual nature.
|
||||
- Publishing others' private information (such as a physical or email address)
|
||||
without their explicit permission.
|
||||
- Other conduct that could reasonably be considered inappropriate in a
|
||||
professional setting.
|
||||
|
||||
For the complete, canonical list of standards and examples, see the
|
||||
[Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
|
||||
|
||||
## Enforcement Responsibilities
|
||||
|
||||
Project maintainers are responsible for clarifying and enforcing these standards
|
||||
and will take appropriate and fair corrective action in response to any behavior
|
||||
they deem inappropriate, threatening, offensive, or harmful.
|
||||
|
||||
Maintainers have the right and responsibility to remove, edit, or reject
|
||||
comments, commits, code, issues, and other contributions that are not aligned
|
||||
with this Code of Conduct, and will communicate reasons for moderation decisions
|
||||
when appropriate.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies within all project spaces — the repository, issues,
|
||||
pull requests, discussions, and the documentation site — and also applies when
|
||||
an individual is officially representing the project in public spaces.
|
||||
|
||||
## Reporting & Enforcement
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||
reported privately to the maintainers at **`conduct@codename-11.dev`**. All
|
||||
complaints will be reviewed and investigated promptly and fairly. Maintainers
|
||||
are obligated to respect the privacy and security of the reporter of any
|
||||
incident.
|
||||
|
||||
For the **Enforcement Guidelines** (the tiered Correction → Warning →
|
||||
Temporary Ban → Permanent Ban ladder maintainers use to determine consequences),
|
||||
see the corresponding section of the
|
||||
[Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/#enforcement-guidelines).
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the
|
||||
[Contributor Covenant](https://www.contributor-covenant.org/), version 2.1.
|
||||
Community Impact Guidelines were inspired by
|
||||
[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
|
||||
+91
@@ -0,0 +1,91 @@
|
||||
# Security Policy
|
||||
|
||||
Hermes-Relay can give a remote AI agent real control of a phone and, via the
|
||||
CLI, of a paired desktop. We take security reports seriously and welcome
|
||||
responsible disclosure.
|
||||
|
||||
For the architecture, threat model, and the `googlePlay` vs. `sideload`
|
||||
capability boundary, see [`docs/security.md`](docs/security.md). This document
|
||||
covers **how to report a problem**.
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
**Please do not open a public issue, discussion, or pull request for a security
|
||||
vulnerability.** Public reports expose users before a fix is available.
|
||||
|
||||
Use one of these private channels instead:
|
||||
|
||||
1. **GitHub Private Vulnerability Reporting (preferred).** Go to the
|
||||
repository's **Security** tab → **Report a vulnerability**, or
|
||||
[open a draft advisory directly](https://github.com/Codename-11/hermes-relay/security/advisories/new).
|
||||
This keeps the whole exchange private and threaded with the code.
|
||||
2. **Email** — `security@codename-11.dev`. Use this if you can't use GitHub.
|
||||
If you'd like to encrypt the report, say so in a first contact message and
|
||||
we'll arrange a key.
|
||||
|
||||
### What to include
|
||||
|
||||
A good report lets us reproduce and assess impact quickly:
|
||||
|
||||
- The affected surface — **Android app** (and which flavor, `googlePlay` or
|
||||
`sideload`), **relay plugin / server**, **desktop CLI**, or the **docs site**.
|
||||
- Affected version(s) — app version/code, plugin version, or CLI version.
|
||||
- A clear description of the issue and its security impact.
|
||||
- Step-by-step reproduction, a proof of concept, or a minimal example.
|
||||
- Any suggested remediation, if you have one.
|
||||
|
||||
> ⚠️ **Scrub secrets before sending.** Remove API keys, relay session tokens,
|
||||
> pairing codes, real hostnames/IPs, and personal data from logs, traces, and
|
||||
> screenshots.
|
||||
|
||||
## What to Expect
|
||||
|
||||
This is an indie, open-source project, so timelines are best-effort rather than
|
||||
contractual:
|
||||
|
||||
- **Acknowledgement** of your report — typically within **5 business days**.
|
||||
- An initial **assessment and severity triage** after we can reproduce it.
|
||||
- **Coordinated disclosure:** we'll work with you on a fix and a disclosure
|
||||
timeline, and credit you in the advisory and release notes if you'd like
|
||||
(or keep you anonymous if you prefer).
|
||||
- A public GitHub Security Advisory and a `CHANGELOG.md` entry once a fix ships.
|
||||
|
||||
## Scope
|
||||
|
||||
**In scope** — vulnerabilities in code this project ships:
|
||||
|
||||
- The Android app (`app/`) on either flavor.
|
||||
- The relay plugin and server (`plugin/`).
|
||||
- The desktop CLI (`desktop/`).
|
||||
- The pairing, auth, transport, media, and tool-routing surfaces.
|
||||
|
||||
**Out of scope** — please report these to the right place instead:
|
||||
|
||||
- **Your own Hermes server configuration** (missing TLS, an exposed dashboard,
|
||||
weak provider keys). The relay connects only to endpoints you configure; how
|
||||
you deploy and secure your Hermes host is outside this app. See
|
||||
[`docs/security.md`](docs/security.md) and the relay-server docs for hardening
|
||||
guidance.
|
||||
- **Upstream [hermes-agent](https://github.com/NousResearch/hermes-agent)**
|
||||
issues — report those to the upstream project (a heads-up to us is welcome if
|
||||
it affects how Hermes-Relay should behave).
|
||||
- **Third-party dependencies** — report upstream; if a dependency issue affects
|
||||
Hermes-Relay users, tell us so we can pin or patch.
|
||||
- Findings that require a **rooted device, a physical-access attacker, or a
|
||||
malicious app already granted Accessibility/overlay permissions** — these are
|
||||
outside the model documented in `docs/security.md`, though we'll still read
|
||||
the report.
|
||||
|
||||
## Safe Harbor
|
||||
|
||||
We consider security research conducted in good faith under this policy to be
|
||||
authorized. We will not pursue or support legal action against researchers who:
|
||||
|
||||
- Make a good-faith effort to avoid privacy violations, data destruction, and
|
||||
service disruption.
|
||||
- Test only against **their own devices, installs, and Hermes servers** — never
|
||||
another person's data or infrastructure.
|
||||
- Report promptly and give us a reasonable chance to remediate before any
|
||||
public disclosure.
|
||||
|
||||
Thank you for helping keep Hermes-Relay and its users safe.
|
||||
Reference in New Issue
Block a user