Add SECURITY.md, issue templates, update CONTRIBUTING

2026-05-06 20:59:54 +02:00
parent edcc1a8424
commit 451054c559
6 changed files with 207 additions and 29 deletions
@@ -0,0 +1,28 @@
+# Security Policy
+
+## Scope
+
+Bach to Basics handles no user accounts, no personal data, and no financial information. It is a local music practice tool — the main attack surface is **file processing** (MIDI, MusicXML, PDF uploads) and the **FastAPI backend** when self-hosted.
+
+## What to report
+
+Worth reporting privately:
+
+- Remote code execution or sandbox escape via a crafted MIDI, MusicXML, or PDF file
+- Server-side vulnerabilities in the FastAPI backend (path traversal, SSRF, etc.)
+- Dependency vulnerabilities with a realistic exploit path
+
+Probably not a security issue (open a regular bug instead):
+
+- Unexpected UI behaviour caused by a malformed music file
+- The app crashing or producing wrong output from bad input
+
+## Reporting
+
+Use **GitHub's private vulnerability reporting**:
+
+1. Go to the [Security tab](https://github.com/gigliof/bach-to-basics/security) of this repo
+2. Click **"Report a vulnerability"**
+3. Fill in the details — steps to reproduce, impact, any suggested fix
+
+You'll get a response within a few days. There's no formal embargo policy given the nature of this project, but please give a reasonable heads-up before going public.