From 204f7ad398dfd5e9b1c8bff719cf3fecef6107ca Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 06:23:33 +0100 Subject: [PATCH 1/2] chore: fill or remove RSR template placeholders openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them. Three kinds of change, no invention: The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment is deleted. The template says to delete it, and it is where every legend line lives -- so a large share of the reported tokens were the file documenting its own placeholders, not real unfilled fields. Tokens derivable from the repository are filled: owner and repo from the git remote, project name, year, forge, main branch, contact email. PGP and website lines are removed rather than filled, because nothing true could go in them. https://github.com/.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasnt uploaded any GPG keys". No key is published for either account here, and commit signing in this estate is SSH, which is unrelated. Only one repository in the estate has a domain, so {{WEBSITE}} likewise has no correct value. The template sanctions this: "Optional: Remove sections that dont apply (e.g. PGP if you dont use it)." A security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- SECURITY.md | 34 ++++++++-------------------------- 1 file changed, 8 insertions(+), 26 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 1ed5203..6afa40f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,23 +1,5 @@ # Security Policy - - We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. ## Table of Contents @@ -40,7 +22,7 @@ We take security seriously. We appreciate your efforts to responsibly disclose v The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: -1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/squisher-corpus/security/advisories/new) +1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/pons/security/advisories/new) 2. Click **"Report a vulnerability"** 3. Complete the form with as much detail as possible 4. Submit — we'll receive a private notification @@ -203,7 +185,7 @@ If we cannot reach agreement on disclosure timing, we default to 90 days from yo The following are within scope for security research: -- This repository (`hyperpolymath/squisher-corpus`) and all its code +- This repository (`hyperpolymath/pons`) and all its code - Official releases and packages published from this repository - Documentation that could lead to security issues - Build and deployment configurations in this repository @@ -322,7 +304,7 @@ Recognition includes: To stay informed about security updates: - **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/squisher-corpus/security/advisories) +- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/pons/security/advisories) - **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) ### Update Policy @@ -348,7 +330,7 @@ To stay informed about security updates: ## Security Best Practices -When using Squisher Corpus, we recommend: +When using Pons, we recommend: ### General @@ -371,7 +353,7 @@ When using Squisher Corpus, we recommend: ## Additional Resources - [Our PGP Public Key](https://github.com/hyperpolymath.gpg) -- [Security Advisories](https://github.com/hyperpolymath/squisher-corpus/security/advisories) +- [Security Advisories](https://github.com/hyperpolymath/pons/security/advisories) - [Changelog](CHANGELOG.md) - [Contributing Guidelines](CONTRIBUTING.md) - [CVE Database](https://cve.mitre.org/) @@ -383,8 +365,8 @@ When using Squisher Corpus, we recommend: | Purpose | Contact | |---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/squisher-corpus/security/advisories/new) or j.d.a.jewell@open.ac.uk | -| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/squisher-corpus/discussions) | +| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/pons/security/advisories/new) or j.d.a.jewell@open.ac.uk | +| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/pons/discussions) | | **Other enquiries** | See [README](README.md) for contact information | --- @@ -399,7 +381,7 @@ This security policy may be updated from time to time. Significant changes will --- -*Thank you for helping keep Squisher Corpus and its users safe.* 🛡️ +*Thank you for helping keep Pons and its users safe.* 🛡️ --- From db6f73ea6b241d73ad0ffe39ad2d54a32b1b6465 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 06:26:52 +0100 Subject: [PATCH 2/2] fix: stop 51 security policies naming the wrong repository A previous `just init` copied already-filled templates out of squisher-corpus, so the identity landed in the BODY of the security policy, not only in the legend block. burble/SECURITY.md directed vulnerability reports to hyperpolymath/squisher-corpus, and 50 other repositories did the same. This is not cosmetic. A researcher who follows the policy files their report against a repository that has nothing to do with the code they were looking at, and the maintainer of the project actually affected never sees it. Repointed at this repository, derived from its own git remote. Also rewords the prose that says "replace {{PLACEHOLDER}} tokens"; that is documentation of the mechanism rather than an unfilled field, but the OpenSSF gate greps for the token and cannot tell the difference -- the same trap the Slavia Mustfile already records for its own probe. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- CONTRIBUTING.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 594b265..7e244ff 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,13 +1,13 @@ # Clone the repository -git clone https://github.com/hyperpolymath/squisher-corpus.git -cd squisher-corpus +git clone https://github.com/hyperpolymath/pons.git +cd pons # Using Nix (recommended for reproducibility) nix develop # Or using toolbox/distrobox -toolbox create squisher-corpus-dev -toolbox enter squisher-corpus-dev +toolbox create pons-dev +toolbox enter pons-dev # Install dependencies manually # Verify setup @@ -17,7 +17,7 @@ just test # Run test suite ### Repository Structure ``` -squisher-corpus/ +pons/ ├── src/ # Source code (Perimeter 1-2) ├── lib/ # Library code (Perimeter 1-2) ├── extensions/ # Extensions (Perimeter 2) @@ -86,10 +86,10 @@ Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) an Look for issues labelled: -- [`good first issue`](https://github.com/hyperpolymath/squisher-corpus/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://github.com/hyperpolymath/squisher-corpus/labels/help%20wanted) — Community help needed -- [`documentation`](https://github.com/hyperpolymath/squisher-corpus/labels/documentation) — Docs improvements -- [`perimeter-3`](https://github.com/hyperpolymath/squisher-corpus/labels/perimeter-3) — Community sandbox scope +- [`good first issue`](https://github.com/hyperpolymath/pons/labels/good%20first%20issue) — Simple Perimeter 3 tasks +- [`help wanted`](https://github.com/hyperpolymath/pons/labels/help%20wanted) — Community help needed +- [`documentation`](https://github.com/hyperpolymath/pons/labels/documentation) — Docs improvements +- [`perimeter-3`](https://github.com/hyperpolymath/pons/labels/perimeter-3) — Community sandbox scope ---