Skip to content

Fix security contact domain in policy docs - #305

Closed
eightynine01 wants to merge 1 commit into
mainfrom
docs/security-contact-domain
Closed

eightynine01 wants to merge 1 commit into
mainfrom
docs/security-contact-domain

Conversation

@eightynine01

Copy link
Copy Markdown
Contributor

This PR was written by an AI agent (Claude Opus 5.5 in Claude Code). It came out of a security review of the KeiaiLab repositories.

Problem

SECURITY.md, docs/SECURITY.*, docs/SUPPORT.* and docs/CODE_OF_CONDUCT.* (13 lines in all) send reports to @keiailab.io addresses. On 2026-10-20 keiailab.io returned NXDOMAIN for MX and NS, and whois keiailab.io answered "Domain not found." As a result:

  • vulnerability reports sent to security@keiailab.io bounce;
  • whoever registers the domain would receive this project's vulnerability reports.

Change

The addresses switch to the keiailab.com ones the other KeiaiLab repositories already publish:

Before After Already used by
security@keiailab.io security@keiailab.com mongodb-, valkey- and qdrant-operator SECURITY.md
support@keiailab.io support@keiailab.com the organisation policy (KeiaiLab/.github SECURITY.md)
coc@keiailab.io conduct@keiailab.com mongodb-operator and keiailab-commons CODE_OF_CONDUCT.md

This is a docs-only change.

Check

  • grep -rn '@keiailab.io' over the tree finds nothing.
  • The three keiailab.com mailboxes accept mail (an owner can confirm by sending a test message).

🤖 Generated with Claude Code

SECURITY.md, docs/SECURITY.*, docs/SUPPORT.* and
docs/CODE_OF_CONDUCT.* send reports to @keiailab.io addresses.
keiailab.io does not resolve (NXDOMAIN) and is not registered, so
vulnerability reports bounce, and whoever registers the domain would
receive them.

Use the keiailab.com addresses the other KeiaiLab repositories
publish: security@ (mongodb, valkey and qdrant operators), support@
(the organisation policy) and conduct@ (mongodb-operator,
keiailab-commons).

Found by an AI-run security review; written by Claude Opus 5.5.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <claude@anthropic.com>
@eightynine01
eightynine01 enabled auto-merge (squash) October 20, 2026 07:54
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-20T07:57:18.079073Z d8c5737 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@eightynine01
eightynine01 disabled auto-merge October 20, 2026 07:58
@eightynine01

Copy link
Copy Markdown
Contributor Author

Parked at the owner's request: work now stays on SwarmOps. The finding stands: keiailab.io is unregistered (NXDOMAIN), so reports sent to these addresses are lost. Reopen this PR or reapply the patch when the owner picks it up. (Comment by an AI agent, Claude Opus 5.5.)

@eightynine01
eightynine01 deleted the docs/security-contact-domain branch October 20, 2026 07:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants