Conversation
…ing policy Member-facing guide to the org hardening: mandatory 2FA, two-person integrity on main (PR + independent approval), zero-access defaults, team-scoped access (Nationals = write on shared public repos, read on most private; special/NDA projects excluded), board scoping, private-repo fork ban, and the repo lifecycle rules. Cross-linked from SECURITY.md, which remains the researcher-facing disclosure policy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Author
|
@khoa-l - please review this PR as a first pass for on-repo guidelines for the national org. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
The member-facing security guide promised in Slack — the org-hardening requirements, verified against live org settings on 2026-09-15 before writing:
mainorg-wide: PR required, 1 approval, approver must differ from the last pusher, threads resolved, no force-push (theprotect-mainruleset)archival-policyruleset)docs/SECURITY.mdgains a one-line pointer at the top and stays the researcher-facing disclosure policy — the two documents now have distinct audiences.No secret team names, no member names, no repo enumeration — publish-safe by construction.
🤖 Generated with Claude Code