Skip to content

Conversation

@RyanCavanaugh
Copy link
Member

Matching https://github.com/microsoft/.github/blob/main/SECURITY.md per security team's request

Copilot AI review requested due to automatic review settings December 3, 2025 22:15
@github-project-automation github-project-automation bot moved this to Not started in PR Backlog Dec 3, 2025
@typescript-bot typescript-bot added Author: Team For Uncommitted Bug PR for untriaged, rejected, closed or missing bug labels Dec 3, 2025
@github-project-automation github-project-automation bot moved this from Not started to Needs merge in PR Backlog Dec 3, 2025
@RyanCavanaugh RyanCavanaugh enabled auto-merge (squash) December 3, 2025 22:17
Copilot finished reviewing on behalf of RyanCavanaugh December 3, 2025 22:17
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the SECURITY.md file to match the standardized Microsoft security documentation template from the microsoft/.github repository, as requested by the security team. The changes streamline and modernize the security reporting instructions.

Key changes:

  • Simplified organization description by removing specific GitHub organization examples
  • Removed the PGP key email submission option
  • Updated follow-up instructions with more detailed guidance, including messaging functionality and additional resource links

If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/security.md/msrc/pgp).

You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc).
You should receive a response within 24 hours. If for some reason you do not, please follow up using the messaging functionality found at the bottom of the Activity tab on your vulnerability report on [https://msrc.microsoft.com/report/vulnerability](https://msrc.microsoft.com/report/vulnerability/) or via email as described in the instructions at the bottom of [https://msrc.microsoft.com/create-report](https://aka.ms/security.md/msrc/create-report). Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc) or on MSRC's [FAQ page for reporting an issue](https://www.microsoft.com/en-us/msrc/faqs-report-an-issue).
Copy link

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The markdown link has an inconsistency: the display text shows https://msrc.microsoft.com/report/vulnerability but the actual URL is https://msrc.microsoft.com/report/vulnerability/ (with a trailing slash). Consider making these consistent by either:

  • Adding the trailing slash to the display text: [https://msrc.microsoft.com/report/vulnerability/](https://msrc.microsoft.com/report/vulnerability/)
  • Or removing the trailing slash from the URL: [https://msrc.microsoft.com/report/vulnerability](https://msrc.microsoft.com/report/vulnerability)
Suggested change
You should receive a response within 24 hours. If for some reason you do not, please follow up using the messaging functionality found at the bottom of the Activity tab on your vulnerability report on [https://msrc.microsoft.com/report/vulnerability](https://msrc.microsoft.com/report/vulnerability/) or via email as described in the instructions at the bottom of [https://msrc.microsoft.com/create-report](https://aka.ms/security.md/msrc/create-report). Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc) or on MSRC's [FAQ page for reporting an issue](https://www.microsoft.com/en-us/msrc/faqs-report-an-issue).
You should receive a response within 24 hours. If for some reason you do not, please follow up using the messaging functionality found at the bottom of the Activity tab on your vulnerability report on [https://msrc.microsoft.com/report/vulnerability/](https://msrc.microsoft.com/report/vulnerability/) or via email as described in the instructions at the bottom of [https://msrc.microsoft.com/create-report](https://aka.ms/security.md/msrc/create-report). Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc) or on MSRC's [FAQ page for reporting an issue](https://www.microsoft.com/en-us/msrc/faqs-report-an-issue).

Copilot uses AI. Check for mistakes.
@RyanCavanaugh RyanCavanaugh merged commit 4ef2378 into main Dec 3, 2025
39 checks passed
@RyanCavanaugh RyanCavanaugh deleted the update-security-md branch December 3, 2025 23:55
@github-project-automation github-project-automation bot moved this from Needs merge to Done in PR Backlog Dec 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Author: Team For Uncommitted Bug PR for untriaged, rejected, closed or missing bug

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

4 participants