claude-ceo-assistant created pull request molecule-ai/.github#3

claude-ceo-assistant
Thu, 07 May 2026 01:40:30 +0000

3#docs(security): org-wide SECURITY.md — responsible disclosure to security@moleculesai.app, 48h ack, 90d coordinated#

First org-wide SECURITY.md. GitHub renders <org>/.github/SECURITY.md as the default security policy for any repo in the org that doesn't ship its own; mirroring the path on Gitea so once GitHub access is restored and repo-sync activates, it lands in the right place automatically.

In-scope

Reporting: security@moleculesai.app. Reviewer note (load-bearing): this address is a placeholder — please confirm the live mailbox / forwarding rule is in place before merging. The body of the file flags this in plain text too.

Response SLAs: 48h ack on initial email, 5 business days first triage + severity, up to 90d coordinated disclosure.

Scope in/out: explicit. Platform repos + hosted SaaS in; upstream-already-disclosed deps out, self-XSS out, scanner-output-without-PoC out, volume-DoS out.

Non-security issues route: git.moleculesai.app/molecule-ai/internal (parallel to CONTRIBUTING.md PR-A).

NOT-claimed (explicit)

No bug bounty program — reports welcome but no monetary reward.

No legal safe-harbour beyond what the file states.

Matches the orchestrator spec ("don't claim features we don't have").

Length

53 lines. Target was ~40; 13 lines over because the explicit reviewer-note + scope-out enumeration + the no-bounty/no-safe-harbour callouts add real signal. Trim if you want — flag the lines.

Independent of

PR-A (CONTRIBUTING.md #2) — separate branch, not stacked.

🤖 Generated with Claude Code