From a376aa8f447dd7307ef0110e7818359afcf097c7 Mon Sep 17 00:00:00 2001 From: Vaclav Vancura Date: Tue, 19 May 2026 18:47:17 +0000 Subject: [PATCH] docs(security): clarify runbook triage and VV-522 fallback wording Replace ambiguous "when available" on the security-label triage step with explicit label, permission, and no-access fallbacks. Name the Maintainers section as the documented VV-522 backup-owner substitute. Co-Authored-By: Claude Signed-off-by: Vaclav Vancura --- docs/security/security-runbook.md | 8 ++++++-- 1 file(s) changed, 6 insertion(s)(+), 2 deletion(s)(-) diff --git a/docs/security/security-runbook.md b/docs/security/security-runbook.md --- a/docs/security/security-runbook.md +++ b/docs/security/security-runbook.md @@ -12,13 +12,17 @@ **Incident triage (solo maintainer):** -1. Open or triage a [GitHub issue](https://github.com/vancura/blit-tech/issues) with label `security` when available. +1. Open or triage a [GitHub issue](https://github.com/vancura/blit-tech/issues): apply label `security` if that label + exists in the repository and you have permission; if it does not exist, create the issue and add the label when you + can edit repository labels. If you cannot create or label issues, contact [@vancura](https://github.com/vancura) + (primary security owner) and record the incident in Linear. 2. Run [Repo-native commands](#repo-native-commands) for the affected repo (`pnpm security:audit`, `pnpm preflight`). 3. Follow [dependency-policy.md](./dependency-policy.md) for CI failures or temporary risk acceptance. 4. Record findings using the [Report template](#report-template) (Linear comment or issue body). Bus-factor evidence (optional): run the `security-ownership-map` skill and attach `summary.json` to hardening reviews. -VV-522 (backup-owner process) was canceled; this section is the documented fallback instead of a fictional backup owner. +VV-522 (backup-owner process) was canceled; the **Maintainers** section above (including incident triage) is the +documented fallback instead of a fictional backup owner. ## When to run -- tangled.sh