From 2ae028e8cf0d10f86245655b55eaf9603d6393ac Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 1 Mar 2026 18:17:21 +0000 Subject: [PATCH 1/2] Initial plan From 03ea49c8f10a537c5db3822c1843b3ef4487a84a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 1 Mar 2026 18:21:26 +0000 Subject: [PATCH 2/2] Add bug bounty program support with SECURITY.md and security report template Co-authored-by: juanaquas <264702634+juanaquas@users.noreply.github.com> --- .github/ISSUE_TEMPLATE/security_report.yml | 113 +++++++++++++++++++++ README.md | 9 ++ SECURITY.md | 95 +++++++++++++++++ 3 files changed, 217 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/security_report.yml create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/security_report.yml b/.github/ISSUE_TEMPLATE/security_report.yml new file mode 100644 index 00000000..ded880b5 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/security_report.yml @@ -0,0 +1,113 @@ +name: Security Vulnerability Report +description: Report a security vulnerability (for non-critical issues only - critical vulnerabilities should go to HackerOne) +title: "[Security]: " +labels: ["security", "triage"] +body: + - type: markdown + attributes: + value: | + ## ⚠️ Important Security Notice + + **For critical security vulnerabilities**, please do NOT use this form. Instead: + - Submit via [GitHub's Bug Bounty on HackerOne](https://hackerone.com/github) + - Email [security@github.com](mailto:security@github.com) + + This form is for **low-severity security concerns** that do not pose immediate risk. + + See our [Security Policy](../../SECURITY.md) for more information. + + - type: checkboxes + id: acknowledgement + attributes: + label: Pre-submission Checklist + description: Please confirm the following before submitting + options: + - label: This is NOT a critical vulnerability that could lead to immediate harm + required: true + - label: I have read the [Security Policy](../../SECURITY.md) + required: true + - label: I am reporting this in good faith as part of responsible disclosure + required: true + + - type: dropdown + id: severity + attributes: + label: Severity Assessment + description: How would you classify this security concern? + options: + - Low - Minor security improvement + - Informational - Security best practice suggestion + validations: + required: true + + - type: dropdown + id: category + attributes: + label: Security Category + description: What category does this security concern fall under? + options: + - Authentication/Authorization + - Data Handling + - Input Validation + - Configuration Security + - Documentation/Security Guidance + - Dependency Security + - Other + validations: + required: true + + - type: textarea + id: description + attributes: + label: Description + description: Describe the security concern in detail + placeholder: Provide a clear description of the security concern... + validations: + required: true + + - type: textarea + id: steps + attributes: + label: Steps to Reproduce (if applicable) + description: Steps to demonstrate the concern + placeholder: | + 1. Run command... + 2. Observe... + validations: + required: false + + - type: textarea + id: impact + attributes: + label: Potential Impact + description: What is the potential impact if this concern is not addressed? + placeholder: Describe the potential impact... + validations: + required: true + + - type: textarea + id: suggestion + attributes: + label: Suggested Fix + description: If you have a suggestion for how to address this concern + placeholder: Describe your suggested approach... + validations: + required: false + + - type: input + id: version + attributes: + label: Copilot CLI Version + description: What version of Copilot CLI are you using? + placeholder: "e.g., 0.0.420" + validations: + required: true + + - type: input + id: os + attributes: + label: Operating System + description: What operating system are you using? + placeholder: "e.g., macOS 15.3, Ubuntu 24.04, Windows 11" + validations: + required: true diff --git a/README.md b/README.md index 347cf2dc..d2111d64 100644 --- a/README.md +++ b/README.md @@ -185,6 +185,15 @@ Check configured LSP servers using the `/lsp` command in an interactive session, For more information, see the [changelog](./changelog.md). +## 🔒 Security + +GitHub Copilot CLI is part of [GitHub's Bug Bounty Program](https://bounty.github.com/). If you discover a security vulnerability, please report it responsibly: + +- **Critical vulnerabilities**: Report via [HackerOne](https://hackerone.com/github) or email [security@github.com](mailto:security@github.com) +- **See our [Security Policy](./SECURITY.md)** for full details on scope, safe harbor, and reporting guidelines + +We appreciate security researchers who help keep Copilot CLI and our users safe. + ## 📢 Feedback and Participation We're excited to have you join us early in the Copilot CLI journey. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..ddc9e4ea --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,95 @@ +# Security Policy + +## GitHub Bug Bounty Program + +GitHub Copilot CLI is part of [GitHub's Bug Bounty Program](https://bounty.github.com/). We encourage security researchers to participate in responsible security testing and disclosure. + +## Supported Versions + +Security updates are provided for the latest stable release of GitHub Copilot CLI: + +| Version | Supported | +| ------- | ------------------ | +| Latest | :white_check_mark: | +| Older | :x: | + +We recommend always updating to the latest version to ensure you have the most recent security patches. + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub issues.** + +If you discover a security vulnerability in GitHub Copilot CLI, please report it through GitHub's Bug Bounty Program: + +1. **Submit via HackerOne**: Report vulnerabilities at [https://hackerone.com/github](https://hackerone.com/github) +2. **Email**: You can also contact [security@github.com](mailto:security@github.com) for security-related issues + +### What to Include + +When reporting a vulnerability, please include: + +- A clear description of the vulnerability +- Steps to reproduce the issue +- Affected versions +- Potential impact assessment +- Any proof-of-concept code (if applicable) + +### Response Timeline + +- **Initial Response**: Within 24-48 hours +- **Status Update**: Within 5 business days +- **Resolution Timeline**: Varies based on severity and complexity + +## Scope + +The following are in scope for security research: + +### In Scope + +- GitHub Copilot CLI application +- Authentication and authorization mechanisms +- Data handling and privacy +- Network communication security +- Local file system interactions +- MCP (Model Context Protocol) server security +- Plugin and extension security +- Session management + +### Out of Scope + +- Third-party dependencies (report to the appropriate maintainers) +- Social engineering attacks +- Denial of service attacks +- Issues requiring physical access to the user's device +- Issues in GitHub's backend services (report via GitHub's main bug bounty) + +## Safe Harbor + +GitHub supports safe harbor for security researchers who: + +- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services +- Only interact with accounts you own or with explicit permission from the account holder +- Do not exploit a security issue for purposes other than testing +- Report any vulnerabilities promptly +- Do not publicly disclose vulnerabilities before they are fixed + +We will not pursue legal action against researchers who follow these guidelines. + +## Security Best Practices for Users + +When using GitHub Copilot CLI: + +1. **Keep Updated**: Always use the latest version +2. **Token Security**: Never share your authentication tokens +3. **Review Actions**: Use plan mode to review actions before execution +4. **MCP Servers**: Only enable trusted MCP servers +5. **Plugins**: Install plugins only from trusted sources + +## Contact + +For non-vulnerability security questions, you can: + +- Open a discussion in this repository +- Use the `/feedback` command within the CLI + +Thank you for helping keep GitHub Copilot CLI and our users safe!