From 9a534e6497ecae38a375262c37ae17d3f1c197ff Mon Sep 17 00:00:00 2001 From: jason5ng32 Date: Sat, 22 Aug 2026 22:30:49 +0800 Subject: [PATCH] Docs(community): route security, conduct and support reports to the right channels MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SECURITY.md used to ask for vulnerability reports in public issues while requesting no public disclosure in the same breath; it now points at GitHub's private advisory form, states the latest-release-only support policy and scopes out non-code findings. The Code of Conduct's enforcement contact β€” a literal blank since the file landed β€” now uses the same private form. New SUPPORT.md and an issue-chooser config send questions to Discussions Q&A and docs before they become issues, and CONTRIBUTING drops its stale "questions also go to Issues" line. Co-Authored-By: Claude Fable 5 --- .github/ISSUE_TEMPLATE/config.yml | 11 +++++++ CODE_OF_CONDUCT.md | 8 +++-- CONTRIBUTING.md | 6 ++-- SECURITY.md | 50 +++++++++++++++++++++---------- SUPPORT.md | 41 +++++++++++++++++++++++++ 5 files changed, 97 insertions(+), 19 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 SUPPORT.md diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 00000000..d17aacd1 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,11 @@ +blank_issues_enabled: true +contact_links: + - name: πŸ“– Documentation + url: https://docs.ipcheck.ing + about: Deployment, MaxMind setup, environment variables, and how each tool works. + - name: πŸ’¬ Questions & help + url: https://github.com/jason5ng32/MyIP/discussions/categories/q-a + about: Setup help, "why does my result look like this", and anything that isn't a bug. + - name: πŸ”’ Report a security vulnerability + url: https://github.com/jason5ng32/MyIP/security/advisories/new + about: Private report, visible only to the maintainer. Please don't open a public issue. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 18c91471..e95d3bea 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -59,8 +59,12 @@ representative at an online or offline event. ## Enforcement Instances of abusive, harassing, or otherwise unacceptable behavior may be -reported to the community leaders responsible for enforcement at -. +reported privately to the maintainer using GitHub's +[private report form](https://github.com/jason5ng32/MyIP/security/advisories/new) +β€” it reaches only the maintainer; start the report with "Code of Conduct" so it +isn't triaged as a security issue. Behavior that violates +[GitHub's own terms](https://github.com/contact/report-abuse) can also be +reported to GitHub directly. All complaints will be reviewed and investigated promptly and fairly. All community leaders are obligated to respect the privacy and security of the diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 96b3489b..c37fa86f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -98,8 +98,10 @@ ships as `beta` until it's complete. Full walkthrough: **[TRANSLATING.md](TRANSL Use the issue templates in [`.github/ISSUE_TEMPLATE/`](.github/ISSUE_TEMPLATE/) β€” one for bug reports (include terminal / browser console logs) and one for feature -requests. For general questions, GitHub Issues is also the right place; there are -no chat channels. +requests. Questions, setup help, and "is this a bug?" go to +[Discussions β†’ Q&A](https://github.com/jason5ng32/MyIP/discussions/categories/q-a) +instead β€” see [SUPPORT.md](SUPPORT.md). Security vulnerabilities go through the +private channel in [SECURITY.md](SECURITY.md), never a public issue. ## Testing diff --git a/SECURITY.md b/SECURITY.md index d04d7af7..6cb9aabb 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,26 +1,46 @@ -## Reporting a Vulnerability +# Security Policy -The security of our project is a top priority. If you discover a security vulnerability, we encourage you to report it directly through our GitHub Issues. +## Supported versions -### How to Report a Vulnerability +Only the latest release gets security fixes. Older tags are not patched β€” if you +self-host, upgrade before reporting. -1. **Report Through GitHub Issues**: Please create a new issue in our [GitHub Issues page](https://github.com/jason5ng32/MyIP/issues). Provide a clear and detailed description of the potential vulnerability. Include steps to reproduce it, if possible. +## Reporting a vulnerability -2. **Avoid Public Disclosure**: To protect the community, please do not disclose the vulnerability publicly until we have had a chance to address it. +**Report privately, not through a public issue.** Use GitHub's private reporting form: -3. **Response Time**: We aim to respond to security issue reports within 48 hours, acknowledging receipt. +**[Report a vulnerability β†’](https://github.com/jason5ng32/MyIP/security/advisories/new)** -4. **Updates**: We will keep you informed about our progress on the issue through the GitHub Issues thread. +It's visible only to the maintainer, and it's the right channel even if you're unsure +whether what you found is a real issue. -5. **Credit**: We value your contribution to the security of this project. We will acknowledge your efforts in the GitHub Issue thread and in our release notes, if a fix is implemented. +Helpful things to include: -## Security Update Process +- What an attacker can do with it, and what they'd need to start (a session? just a URL?). +- Steps to reproduce β€” a request, a payload, or a short script. +- Where the problem lives: front-end (`frontend/`), API handler (`api/`), or shared + code (`common/`). +- Whether you hit it on [ipcheck.ing](https://ipcheck.ing) or your own deployment, and + the version if self-hosted. -Upon receiving a report of a vulnerability, our team will: +## What to expect -- Promptly investigate the issue. -- Develop a fix and test it thoroughly. -- Release an updated version that addresses the issue. -- Provide updates and patches as needed. +- An acknowledgement within a few days. +- A fix in the next release once it's confirmed, or an explanation if it turns out to be + out of scope. +- Credit in the release notes and the advisory, unless you'd rather stay anonymous. -Thank you for helping us keep our project safe and secure. +Please hold off on public disclosure until a fix ships. + +## Out of scope + +- **Findings against [ipcheck.ing](https://ipcheck.ing) infrastructure** rather than this + codebase β€” rate limits, TLS configuration, DNS, hosting. Report those the same way, but + they aren't code issues. +- **Third-party data providers.** MyIP queries external IP-geolocation and network APIs; + their vulnerabilities belong to them. +- **Automated scanner output** with no working proof of concept. +- **Missing optional hardening in a self-hosted instance.** `ALLOWED_DOMAINS` and the + other environment settings are documented in the + [Developer Guide](https://docs.ipcheck.ing/developer) β€” an instance running without them + is misconfigured, not vulnerable. diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 00000000..53376d5d --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,41 @@ +# Getting help + +Start with the docs, then pick the channel that matches what you need. + +## Documentation first + +The **[MyIP Docs Center](https://docs.ipcheck.ing)** covers most questions, in English, +δΈ­ζ–‡, franΓ§ais and русский: + +- **[Developer Guide](https://docs.ipcheck.ing/developer)** β€” deployment (Node, Docker, + Vercel), MaxMind setup, reverse proxies and `ALLOWED_DOMAINS`, environment variables, + architecture. +- **[Knowledge Base](https://docs.ipcheck.ing/knowledge-base)** β€” what each tool measures + and how to read its results. + +Two settings account for most self-hosting problems: MaxMind credentials (without them +the MaxMind source returns 503) and `ALLOWED_DOMAINS` (without it every request from a +non-localhost domain gets 403). + +## Where to ask + +| You want to… | Go to | +|---|---| +| Ask how to do something, or why a result looks odd | [Discussions β†’ Q&A](https://github.com/jason5ng32/MyIP/discussions/categories/q-a) | +| Report a bug you can reproduce | [New issue β†’ Bug report](https://github.com/jason5ng32/MyIP/issues/new?template=bug_report.md) | +| Suggest a feature | [New issue β†’ Feature request](https://github.com/jason5ng32/MyIP/issues/new?template=feature_request.md) | +| Report a security vulnerability | [Private advisory](https://github.com/jason5ng32/MyIP/security/advisories/new) β€” see [SECURITY.md](SECURITY.md) | +| Contribute code or a translation | [CONTRIBUTING.md](CONTRIBUTING.md) Β· [TRANSLATING.md](TRANSLATING.md) | + +There are no chat channels β€” everything happens on GitHub, in the open, so the next +person with the same question can find the answer. + +## Making your question answerable + +Deployment questions need: how you're running it (Docker / Node / Vercel), the version, +what you set for `ALLOWED_DOMAINS` and MaxMind, and the backend terminal output. +Page questions need: browser, what you saw versus what you expected, and any errors from +the browser console. + +MyIP is maintained by one person in their spare time. Replies aren't instant, and a +question that already contains the details above gets answered a lot sooner.