Conversation
…ing policy Member-facing guide to the org hardening: mandatory 2FA, two-person integrity on main (PR + independent approval), zero-access defaults, team-scoped access (Nationals = write on shared public repos, read on most private; special/NDA projects excluded), board scoping, private-repo fork ban, and the repo lifecycle rules. Cross-linked from SECURITY.md, which remains the researcher-facing disclosure policy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Author
|
@khoa-l - please review this PR as a first pass for on-repo guidelines for the national org. |
khoa-l
requested changes
Sep 18, 2026
khoa-l
left a comment
khoa-l
left a comment
Contributor
There was a problem hiding this comment.
Couple small changes, but looks good
|
|
||
| - Your GitHub account must have **two-factor authentication enabled**. GitHub enforces this at the org level: you can't join, and can't remain, without it. Use an authenticator app or passkey rather than SMS if you can. | ||
| - Edits made through the GitHub web editor require a **sign-off** (GitHub adds it when you tick the box on the commit form). If a web commit is rejected, that's why. | ||
| - Use your own account only. Never share credentials or tokens, and never commit secrets (API keys, passwords, partner data) to any repo, public or private. |
Contributor
There was a problem hiding this comment.
Let's add info about getting access to and using the Vaultwarden resource here. Or at least mention that it's an approved resource for this.
Although we will probably need a similar how to use the Vaultwarden document for the leadership in chare of that.
|
|
||
| --- | ||
|
|
||
| Questions about any of this? Ask your chapter lead first, or open a thread in the org Slack. |
Contributor
There was a problem hiding this comment.
Should we point them to a channel? We have #hack-overflow or just have them post in #general?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
The member-facing security guide promised in Slack — the org-hardening requirements, verified against live org settings on 2026-09-15 before writing:
mainorg-wide: PR required, 1 approval, approver must differ from the last pusher, threads resolved, no force-push (theprotect-mainruleset)archival-policyruleset)docs/SECURITY.mdgains a one-line pointer at the top and stays the researcher-facing disclosure policy — the two documents now have distinct audiences.No secret team names, no member names, no repo enumeration — publish-safe by construction.
🤖 Generated with Claude Code