docs: add code of conduct, security policy and changelog - #1
Open
jhogendorn wants to merge 1 commit into
Open
Conversation
Completes the contributor file set; CONTRIBUTING was already here. The security policy is specific to what lup does rather than generic. Because lup walks *upward*, every directory above the caller is an input, including ones the caller does not own. On a shared host an attacker who can write to an ancestor can plant a file that lup will find and return — and the documented usage is `source $(lup .env)` and `eval $(lup -e .env)`, so that becomes shell execution. Same class as a VCS honouring config from a parent directory. Named as the primary threat, with the boundary flags (-g, -r) and -a given as the mitigation. The changelog documents 0.1.0 against the actual CLI surface read out of src/cli.rs, not the README summary. A first draft said "-e evaluates contents"; it prints them and the shell evaluates, which matters for anyone reasoning about the security note above. Also states which classes of change get called out regardless of size: where lup looks, what it matches, where it stops, how it follows symlinks. Those are what scripts depend on. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the contributor file set. CONTRIBUTING.md was already present.
SECURITY.md is specific rather than boilerplate. Because lup walks upward, every ancestor directory is an input — including ones the caller does not own. On a shared host, someone who can write to an ancestor can plant a file lup will find and return, and the documented usage is
source $(lup .env). Same class of problem as a VCS honouring config from a parent directory, so it is named as the primary threat, with -g, -r and -a given as mitigations.CHANGELOG.md documents 0.1.0 against the CLI surface read out of src/cli.rs rather than the README summary — my first draft claimed -e evaluates contents, when it prints them and the shell evaluates. That distinction matters given the security note.
Note this repo has no develop branch, unlike the other five, so this targets main.