security-insights.yml

Rama main · réplica de lectura del repositorio original.

header:
  schema-version: 2.2.0
  last-updated: '2026-11-11'
  last-reviewed: '2026-10-12'
  url: https://raw.githubusercontent.com/bailinghub/bailinghub/main/security-insights.yml
  comment: >-
    Project security information maintained by BailingHub Core. This document
    records published policies and evidence; it is not an OSPS assessment or
    security certification.

project:
  name: BailingHub Core
  homepage: https://www.bailinghub.com
  administrators:
    - name: Jingchuan Nie
      primary: true
      social: https://github.com/niejingchuan
  repositories:
    - name: BailingHub Core
      url: https://github.com/bailinghub/bailinghub
      comment: >-
        Self-hosted runtime, administration console and reference demo in this
        repository. Independently released ecosystem adapters and ACC are
        outside this assessment scope.
  vulnerability-reporting:
    reports-accepted: true
    bug-bounty-available: false
    policy: https://github.com/bailinghub/bailinghub/blob/main/SECURITY.md
    comment: >-
      SECURITY.md requests private reports and targets acknowledgement within
      three business days. GitHub private vulnerability reporting was confirmed enabled by the
      repository API on 2026-10-10. The direct report URL is
      https://github.com/bailinghub/bailinghub/security/advisories/new.
      No report was submitted as part of this check.
      The project is independently maintained with no designated external
      open-source steward. SECURITY.md describes project stewardship and
      CONTRIBUTING.md documents security incident coordination. This is not a
      claim of CRA legal compliance or certification.
  documentation:
    quickstart-guide: https://github.com/bailinghub/bailinghub/blob/main/docs/QUICKSTART.en.md
    detailed-guide: https://github.com/bailinghub/bailinghub/blob/main/docs/README.md
    design: https://github.com/bailinghub/bailinghub/blob/main/docs/ARCHITECTURE.en.md
    code-of-conduct: https://github.com/bailinghub/bailinghub/blob/main/CODE_OF_CONDUCT.md
    support-policy: https://github.com/bailinghub/bailinghub/blob/main/SECURITY.md

repository:
  url: https://github.com/bailinghub/bailinghub
  status: active
  accepts-change-request: true
  accepts-automated-change-request: true
  core-team:
    - name: Jingchuan Nie
      primary: true
      social: https://github.com/niejingchuan
  license:
    expression: Apache-2.0
    url: https://github.com/bailinghub/bailinghub/blob/main/LICENSE
  documentation:
    contributing-guide: https://github.com/bailinghub/bailinghub/blob/main/CONTRIBUTING.md
    governance: https://github.com/bailinghub/bailinghub/blob/main/GOVERNANCE.md
    security-policy: https://github.com/bailinghub/bailinghub/blob/main/SECURITY.md
  release:
    automated-pipeline: true
    distribution-points:
      - uri: https://github.com/bailinghub/bailinghub/releases
        comment: Public versioned releases.
      - uri: https://github.com/bailinghub/bailinghub/pkgs/container/bailinghub
        comment: Container images published by the Images workflow.
    changelog: https://github.com/bailinghub/bailinghub/blob/main/docs/CHANGELOG.en.md
  security:
    assessments:
      self:
        name: Repository security self-assessment
        evidence: https://github.com/bailinghub/bailinghub/blob/main/SECURITY_SELF_ASSESSMENT.md
        comment: >-
          Maintainer assessment of the repository's scope, design, threats,
          development practices and remaining gaps. This is not an independent
          audit or a claim that all OSPS Baseline requirements pass.
    tools:
      - name: OSPS Baseline Scanner (Privateer)
        type: other
        version: '0.31.0'
        rulesets:
          - osps-baseline-2026-08
        comment: >-
          Fixed-digest Privateer GitHub repository scanner with read-only
          permissions, weekly scheduling and workflow_dispatch. Initial manual
          results are available; workflow success does not imply control success.
        integration:
          adhoc: true
          ci: true
          release: false
        results:
          adhoc:
            name: Initial manual OSPS Baseline evaluation
            predicate-uri: https://github.com/ossf/pvtr-github-repo-scanner
            location: https://github.com/bailinghub/bailinghub/actions/runs/38016927247
          ci:
            name: OSPS Baseline evaluation
            predicate-uri: https://github.com/ossf/pvtr-github-repo-scanner
            location: https://github.com/bailinghub/bailinghub/actions/workflows/osps-baseline.yml