From 1646f4d20031befcc72cc506844373faeb36c748 Mon Sep 17 00:00:00 2001 From: Will Kahn-Greene Date: Fri, 25 Sep 2026 08:01:51 -0400 Subject: [PATCH] docs: bring SECURITY.md up to date Closes #95. The support window was already decided (latest release only), and the version table waits until there is more than one line; this settles the rest: - The token note says what was confirmed: Atlassian's UI offers no edit or rotation for a personal API token, only revocation. Scoped service-account tokens are assumed to behave the same; nobody here can check. - Image paths are bounded by the documentation root, not the working directory, since the root model changed. - A report asks about standard vs Government/isolated Cloud, not Data Center, which is out of scope. --- SECURITY.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index a5fe66a..ab3d1fd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -11,14 +11,15 @@ That opens a draft advisory only you and the maintainers can see. Helpful things to include: - the command you ran, and the version (`markfluence --version`) -- whether the site is Confluence Cloud or Data Center +- whether the site is standard Confluence Cloud, or Atlassian Government or + isolated Cloud - the smallest reproduction you can manage > [!IMPORTANT] > **Don't put a real API token, or a token fragment, in a report.** If you think -> a token was exposed while you were investigating, revoke it first — an -> Atlassian API token can't be rotated in place, so recovery means issuing a new -> one. A redacted site URL is fine (use example.com); say so if you've redacted it. +> a token was exposed while you were investigating, revoke it first. An +> Atlassian API token can't be edited or rotated in place — Atlassian's UI only +> revokes one — so recovery means revoking it and issuing a new one. A redacted site URL is fine (use example.com); say so if you've redacted it. Reports are handled on a best-effort basis by a small number of maintainers. There's no guaranteed response time. Once there's a fix, disclosure is @@ -53,7 +54,9 @@ the destination directory. A path that escapes that clamp is an arbitrary file write driven by a Confluence page you may not control. **Reading files outside the documentation root.** When publishing, image paths -resolve relative to the Markdown file and are bounded by the working directory. +resolve relative to the Markdown file and are bounded by its documentation +root: the nearest directory above the file with a `markfluence.yaml`, or the +file's own directory if there is none. A path that escapes that bound would publish a local file the author never meant to expose.