Extend Security Best Practices for your Project #3465

UlisesGascon · 2025-07-09T14:28:47Z

cc: @KevinCrosby, @Jeffrey-Luszcz @DUBSOpenHub @jonchurch @blakeembrey @ljharb @RafaelGSS

Note: This PR will impact #3462 and #3461

_articles/security-best-practices-for-your-project.md

UlisesGascon · 2025-07-09T14:31:42Z

_articles/security-best-practices-for-your-project.md

+
+Using open source dependencies can speed up development, but each package includes a license that defines how it can be used, modified, or distributed. Some licenses are permissive, while others (like AGPL or SSPL) impose restrictions that may not be compatible with your project's goals or your users' needs.
+
+Imagine this: You add a powerful library to your project, unaware that it uses a restrictive license. Later, a company wants to adopt your project but raises concerns about license compliance. The result? You lose adoption, need to refactor code, and your project’s reputation takes a hit.


@Jeffrey-Luszcz feel free to suggest a better example for the mixed-license scenario in the license section. You probably have a much stronger one than mine 🙏

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

github-actions · 2025-08-09T12:08:22Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

_articles/security-best-practices-for-your-project.md

xcorail

Nice additions!
I will let @Jeffrey-Luszcz weigh in on the licensing stuff, and I made a suggestion for the IR plan section, but I like the rest.

jmeridth · 2025-09-25T16:40:54Z

@UlisesGascon I see @xcorail has some suggestions above. Can you take a look and discuss/accomodate? I've pinged @Jeffrey-Luszcz and he'll be taking a look when he can. Thank you for the contribution.

_articles/security-best-practices-for-your-project.md

tomthorogood · 2025-09-26T16:51:48Z

_articles/security-best-practices-for-your-project.md

+
+Imagine this: You add a powerful library to your project, unaware that it uses a restrictive license. Later, a company wants to adopt your project but raises concerns about license compliance. The result? You lose adoption, need to refactor code, and your project's reputation takes a hit.
+
+To avoid these pitfalls, consider including automated license checks as part of your development workflow. These checks can help identify incompatible licenses early in the process, preventing problematic dependencies from being introduced into your project.


Is there an existing auto license check tool that we could link users to?

Not an expert on this, but we could point readers to a couple of options but not easy to adopt (IMO).

For example, FOSSA is a commercial tool that provides automated license-compliance scanning, and there’s also the OSS Review Toolkit (ORT), an open-source option that includes a license scanner: https://oss-review-toolkit.org/ort/docs/tools/scanner/

Most of the scanners I use personally are specific to npm universe 🤔.

@Jeffrey-Luszcz wdyt?

for npm? npmjs.com/licensee

jmeridth · 2025-10-17T16:16:06Z

Converting to draft until author re-engages.

UlisesGascon · 2025-10-17T16:56:18Z

I plan to rework on this PR next week once I am back from vacations

Ref: github#3465 (comment)

_articles/security-best-practices-for-your-project.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

Ref: github#3465 (comment)

xcorail

LGTM for me - I just suggested a typo fix.
I will approve the PR, but I defer to @Jeffrey-Luszcz for the licensing part

Thanks @UlisesGascon for these additions!

_articles/security-best-practices-for-your-project.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

wissamhalabi1233-netizen · 2025-11-06T22:20:13Z

_articles/security-best-practices-for-your-project.md

 A new contributor gets write access to the main branch and accidentally pushes changes that have not been tested. A dire security flaw is then uncovered, courtesy of the latest changes. To prevent such issues, branch protection rules ensure that changes cannot be pushed or merged into important branches without first undergoing reviews and passing specified status checks. You're safer and better off with this extra measure in place, guaranteeing top-notch quality every time.

-## Set up an intake mechanism for vulnerability reporting
+## Make it easy (and safe) to report security issues


0x217ee1740bc4ba7d6b708b79094b675783201402

wissamhalabi1233-netizen · 2025-11-13T15:18:05Z

_articles/security-best-practices-for-your-project.md


 A new contributor gets write access to the main branch and accidentally pushes changes that have not been tested. A dire security flaw is then uncovered, courtesy of the latest changes. To prevent such issues, branch protection rules ensure that changes cannot be pushed or merged into important branches without first undergoing reviews and passing specified status checks. You're safer and better off with this extra measure in place, guaranteeing top-notch quality every time.

-## Set up an intake mechanism for vulnerability reporting


0x217ee1740bc4ba7d6b708b79094b675783201402

UlisesGascon added 5 commits July 9, 2025 16:15

docs: mention license risks

becfcd3

docs: mention team effort

dc4df46

docs: mention threat models

c5ea56b

docs: mention IRP

272fa26

docs: minor changes

6b4e258

Copilot AI review requested due to automatic review settings July 9, 2025 14:28

UlisesGascon requested a review from a team as a code owner July 9, 2025 14:28

UlisesGascon temporarily deployed to Pages Preview July 9, 2025 14:28 — with GitHub Actions Inactive

UlisesGascon commented Jul 9, 2025

View reviewed changes

_articles/security-best-practices-for-your-project.md Show resolved Hide resolved

UlisesGascon temporarily deployed to Pages Preview July 9, 2025 14:29 — with GitHub Actions Inactive

UlisesGascon commented Jul 9, 2025

View reviewed changes

chore: linting

9e75f8c

UlisesGascon temporarily deployed to Pages Preview July 9, 2025 14:45 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview July 9, 2025 14:46 — with GitHub Actions Inactive

Copilot AI reviewed Jul 9, 2025

View reviewed changes

github-actions bot added the stale label Aug 9, 2025

Merge branch 'main' into update-seccurity

969353d

UlisesGascon temporarily deployed to Pages Preview August 9, 2025 12:40 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview August 9, 2025 12:41 — with GitHub Actions Inactive

github-actions bot removed the stale label Aug 10, 2025

Merge branch 'main' into update-seccurity

e886ee9

jmeridth temporarily deployed to Pages Preview August 12, 2025 14:17 — with GitHub Actions Inactive

jmeridth temporarily deployed to Pages Preview August 12, 2025 14:18 — with GitHub Actions Inactive

jmeridth requested a review from Jeffrey-Luszcz August 12, 2025 14:22

xcorail reviewed Sep 2, 2025

View reviewed changes

_articles/security-best-practices-for-your-project.md Outdated Show resolved Hide resolved

xcorail reviewed Sep 2, 2025

View reviewed changes

tomthorogood reviewed Sep 26, 2025

View reviewed changes

This comment has been minimized.

Sign in to view

This comment was marked as spam.

Sign in to view

jmeridth marked this pull request as draft October 17, 2025 16:15

This comment was marked as spam.

Sign in to view

Merge branch 'main' into update-seccurity

949a027

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 14:51 — with GitHub Actions Inactive

chore: relocate section

3a53077

Ref: github#3465 (comment)

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 15:04 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 15:05 — with GitHub Actions Inactive

chore: add link for better context

be54004

Ref: github#3465 (comment)

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 15:08 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 15:09 — with GitHub Actions Inactive

UlisesGascon marked this pull request as ready for review November 13, 2025 15:23

UlisesGascon requested a review from xcorail November 13, 2025 15:23

xcorail suggested changes Nov 13, 2025

View reviewed changes

_articles/security-best-practices-for-your-project.md Show resolved Hide resolved

_articles/security-best-practices-for-your-project.md Outdated Show resolved Hide resolved

_articles/security-best-practices-for-your-project.md Outdated Show resolved Hide resolved

Update _articles/security-best-practices-for-your-project.md

c4edccf

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:10 — with GitHub Actions Inactive

Update _articles/security-best-practices-for-your-project.md

0372fab

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:11 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:12 — with GitHub Actions Inactive

docs: add missing subtitle

c2a63a3

Ref: github#3465 (comment)

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:13 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:14 — with GitHub Actions Inactive

xcorail approved these changes Nov 14, 2025

View reviewed changes

_articles/security-best-practices-for-your-project.md Outdated Show resolved Hide resolved

Update _articles/security-best-practices-for-your-project.md

42523a4

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 08:51 — with GitHub Actions Inactive

UlisesGascon deployed to Pages Preview November 14, 2025 08:52 — with GitHub Actions View deployment

wissamhalabi1233-netizen reviewed Nov 15, 2025

View reviewed changes


		Using open source dependencies can speed up development, but each package includes a license that defines how it can be used, modified, or distributed. Some licenses are permissive, while others (like AGPL or SSPL) impose restrictions that may not be compatible with your project's goals or your users' needs.

		Imagine this: You add a powerful library to your project, unaware that it uses a restrictive license. Later, a company wants to adopt your project but raises concerns about license compliance. The result? You lose adoption, need to refactor code, and your project’s reputation takes a hit.


		Imagine this: You add a powerful library to your project, unaware that it uses a restrictive license. Later, a company wants to adopt your project but raises concerns about license compliance. The result? You lose adoption, need to refactor code, and your project's reputation takes a hit.

		To avoid these pitfalls, consider including automated license checks as part of your development workflow. These checks can help identify incompatible licenses early in the process, preventing problematic dependencies from being introduced into your project.


		A new contributor gets write access to the main branch and accidentally pushes changes that have not been tested. A dire security flaw is then uncovered, courtesy of the latest changes. To prevent such issues, branch protection rules ensure that changes cannot be pushed or merged into important branches without first undergoing reviews and passing specified status checks. You're safer and better off with this extra measure in place, guaranteeing top-notch quality every time.

		## Set up an intake mechanism for vulnerability reporting

Extend Security Best Practices for your Project #3465

Are you sure you want to change the base?

Extend Security Best Practices for your Project #3465

Conversation

UlisesGascon commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

Uh oh!

xcorail left a comment

Choose a reason for hiding this comment

Uh oh!

jmeridth commented Sep 25, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment was marked as spam.

jmeridth commented Oct 17, 2025

Uh oh!

UlisesGascon commented Oct 17, 2025

Uh oh!

This comment was marked as spam.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xcorail left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

UlisesGascon commented Jul 9, 2025 •

edited

Loading