From 9cb45297073b06d3535f94ba9cdb9f4844752c23 Mon Sep 17 00:00:00 2001 From: Hossein Date: Fri, 25 Sep 2026 21:43:19 -0400 Subject: [PATCH 1/5] ci: add weekly Dependabot version updates Weekly updates for the package ecosystems this repository uses, minor and patch grouped per ecosystem, at most five open pull requests each. --- .github/dependabot.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..319d4b8 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,34 @@ +# Dependabot version updates. Weekly, at most five open pull requests per +# ecosystem, and minor and patch updates grouped into one pull request per +# ecosystem so they arrive together. A major update opens on its own. Nothing +# merges without a review. +version: 2 +updates: + - package-ecosystem: "uv" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + commit-message: + prefix: "chore" + include: "scope" + groups: + uv-minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + commit-message: + prefix: "chore" + include: "scope" + groups: + github-actions: + patterns: + - "*" From 56fe0919aab14958e0202e01ed63fff80724a0e5 Mon Sep 17 00:00:00 2001 From: Hossein Date: Fri, 25 Sep 2026 21:43:19 -0400 Subject: [PATCH 2/5] docs: add a security policy Reports go to security@scadable.com and are acknowledged within one business day, the promise the trust center makes. No bug bounty. --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..822bdd5 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,21 @@ +# Security policy + +## Reporting a vulnerability + +Please do not report security problems through public issues, discussions or +pull requests. + +Email security@scadable.com with: + +- a description of the problem and where you found it; +- the steps to reproduce it; +- what an attacker could do with it, if you know. + +We acknowledge every report within one business day and keep you updated as +we work on a fix. When the problem is fixed, we will tell you. + +SCADABLE does not run a bug bounty program and does not pay for reports. + +## Supported versions + +We fix security problems on the default branch and in the latest release. From 4f789683d830b62ab1a50a079b47add714761511 Mon Sep 17 00:00:00 2001 From: Hossein Date: Fri, 25 Sep 2026 21:43:19 -0400 Subject: [PATCH 3/5] chore: give every path a code owner A catch-all rule for @scadable/founders, above any existing narrower rules. --- .github/CODEOWNERS | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..742fc8b --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,3 @@ +# Every path has an owner, so GitHub requests a review from the founders team +# on each pull request. +* @scadable/founders From 9d9bd9441bbd0d22b205b3e8a225f5142baae3a2 Mon Sep 17 00:00:00 2001 From: Hossein Date: Fri, 25 Sep 2026 22:04:27 -0400 Subject: [PATCH 4/5] docs: reply to security reports within five business days The Vulnerability and Patch Management Policy (section 4.3) promises an outside reporter a reply within five business days, and scadable.com/security and the trust center seed (landing#11, trust-manager#41) say the same. One business day was a promise no policy backs. What to include now matches the website, and the file promises only what the policy does. --- SECURITY.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 822bdd5..df829a3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,15 +7,17 @@ pull requests. Email security@scadable.com with: -- a description of the problem and where you found it; +- what you found, and where: the URL, endpoint or repository; - the steps to reproduce it; -- what an attacker could do with it, if you know. +- the impact you think it has; +- how we can reach you. -We acknowledge every report within one business day and keep you updated as -we work on a fix. When the problem is fixed, we will tell you. +We reply within five business days. When we confirm a problem, we rate its +severity and fix it on the timeline that severity sets. -SCADABLE does not run a bug bounty program and does not pay for reports. +SCADABLE does not run a bug bounty program. ## Supported versions -We fix security problems on the default branch and in the latest release. +Only the default branch is supported. A fix is made there and reaches users in +the next release or deploy. From c8ec0e4b57278c7044bba57f24f3ffa970d67c62 Mon Sep 17 00:00:00 2001 From: Hossein Date: Fri, 25 Sep 2026 22:04:27 -0400 Subject: [PATCH 5/5] ci: describe the Dependabot configuration as it is No branch protection requires a review yet, so the header no longer says nothing merges without one. It says instead that Dependabot only opens pull requests, and, where the file has one, that the GitHub Actions entry groups every update, majors included. --- .github/dependabot.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 319d4b8..a246a7c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,8 @@ # Dependabot version updates. Weekly, at most five open pull requests per # ecosystem, and minor and patch updates grouped into one pull request per -# ecosystem so they arrive together. A major update opens on its own. Nothing -# merges without a review. +# ecosystem so they arrive together. A major update opens on its own, except +# for GitHub Actions, where every update is grouped (see that entry). +# Dependabot only opens pull requests; nothing in this file merges one. version: 2 updates: - package-ecosystem: "uv"