Security Policy
Relevant source files
The following files were used as context for generating this wiki page:The spec-kit project, managed through the GitHub organization, takes the security of its software and services seriously. The policy is centered on coordinated disclosure for reporting vulnerabilities and integrating security considerations directly into the Spec-Driven Development (SDD) lifecycle.
While open source repositories are outside the scope of GitHub's bug bounty program, all findings are reviewed and passed to the appropriate maintainers for remediation.
Sources: SECURITY.md:5-11
Reporting Security Issues
If you believe you have found a security vulnerability, it is critical to report it through coordinated disclosure. Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Instead, please send an email to opensource-security[@]github.com.
Sources: SECURITY.md:16-19
Reporting Process Flow
The following diagram illustrates the correct procedure for reporting a security vulnerability.
This diagram shows the process for responsible disclosure.
Sources: SECURITY.md:16-21
Information for Reports
To help triage and resolve the issue quickly, please include as much of the following information as possible in your report.
| Information Required | Description |
|---|---|
| Type of issue | e.g., buffer overflow, SQL injection, or cross-site scripting. |
| Full paths of source file(s) | The specific source files related to the manifestation of the issue. |
| Location of the affected source code | The tag, branch, commit, or direct URL of the affected code. |
| Special configuration | Any special configuration required to reproduce the issue. |
| Step-by-step instructions | Clear, sequential instructions to reproduce the issue. |
| Proof-of-concept or exploit code | If possible, provide code to demonstrate the vulnerability. |
| Impact of the issue | An explanation of how an attacker might exploit the issue. |
Sources: SECURITY.md:23-31
Security in the Development Lifecycle
The Spec-Driven Development (SDD) methodology integrates security considerations from the earliest stages of development, ensuring it is a foundational aspect rather than an afterthought.
Sources: spec-driven.md:52-54
SDD Security Integration Flow
The diagram below shows how security is embedded into the specification and planning phases of the SDD workflow.
This diagram shows how security is considered at each step of the SDD process.
Sources: templates/spec-template.md:28-33, spec-driven.md:52-54, templates/plan-template.md:120-121
Key integration points include:
- Specification Phase: The
spec-template.mdexplicitly lists "Security/compliance needs" as a common area that must be clarified. If a user prompt is ambiguous, it must be marked with[NEEDS CLARIFICATION]. This prevents assumptions and forces security to be considered upfront.
Sources: templates/spec-template.md:32-33 - Research and Planning: During the planning phase, research agents can be tasked with investigating security implications. The implementation plan also explicitly includes tasks for security-related components like authentication middleware and security headers.
Sources: spec-driven.md:52-54, templates/plan-template.md:120-121 - Enterprise Constraints: The SDD process is designed to incorporate organizational constraints, which include compliance and security requirements, directly into the specifications.
Sources: README.md:68-70
Policies and Developer Practices
Scope and Safe Harbor
- Open source repositories like
spec-kitare outside the scope of the GitHub bug bounty program and are not eligible for rewards. - All reports are still investigated and remediated by maintainers.
- The project adheres to GitHub's Safe Harbor Policy.
Sources: SECURITY.md:8-11, 35
Git Authentication
For developers contributing to the project, it is recommended to use secure methods for Git authentication. For Linux users experiencing issues, installing and configuring the Git Credential Manager (GCM) is a suggested solution.
Sources: README.md:258-268