docs: improve vulnerability reporting guide#1128
Merged
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughUpdated repository documentation to expand and reorganize security vulnerability reporting guidance: README.md adjusts the documentation table and Security section; SECURITY.md adds detailed reporting channels, submission steps, checklist, and expected handling; docs/index.md adds a "Report Vulnerabilities" link to SECURITY.md. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
README.md (1)
1-2:⚠️ Potential issue | 🟠 MajorAdd the required SPDX header at the top of
README.md.The Markdown SPDX copyright/license header is missing.
Proposed fix
+<!-- + SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. + SPDX-License-Identifier: Apache-2.0 +--> + # 🦞 NVIDIA NemoClaw: Reference Stack for Running OpenClaw in OpenShellAs per coding guidelines,
**/*.{js,cjs,mjs,ts,tsx,sh,md}files must include SPDX headers and Markdown files must use HTML comments.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` around lines 1 - 2, Add the required SPDX Markdown header to the top of README.md (above the existing title line "# 🦞 NVIDIA NemoClaw: Reference Stack for Running OpenClaw in OpenShell"): insert the two HTML comment SPDX lines (copyright text and SPDX-License-Identifier) as per project policy so the file contains the SPDX header in HTML comment form for Markdown files; ensure the header appears before any other content and follows the same format used across other docs in the repo.
🧹 Nitpick comments (1)
SECURITY.md (1)
8-8: Use active voice in these sentences.Both lines use passive constructions; rewrite to active voice for docs consistency.
As per coding guidelines, "Active voice required. Flag passive constructions."
Also applies to: 53-53
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@SECURITY.md` at line 8, Rewrite the passive sentences to active voice: replace "If a potential security issue is inadvertently reported through a public channel, NVIDIA maintainers may limit public discussion and redirect the reporter to the appropriate private disclosure channels." with an active-voice version that names the actor and direct object (for example: "If you inadvertently report a potential security issue through a public channel, NVIDIA maintainers may limit public discussion and will redirect you to the appropriate private disclosure channels."); apply the same change to the related sentence at the other occurrence (the line referenced as also applies to: 53-53) so both instances use active voice and address the reporter directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@SECURITY.md`:
- Around line 1-3: Add an SPDX header HTML comment at the very top of the
Markdown file before the "## Security" heading: insert the required SPDX
copyright and license block (in HTML comment form) as specified by the coding
guidelines so the file includes the SPDX header for Markdown files; ensure the
comment appears above the existing "## Security" line.
---
Outside diff comments:
In `@README.md`:
- Around line 1-2: Add the required SPDX Markdown header to the top of README.md
(above the existing title line "# 🦞 NVIDIA NemoClaw: Reference Stack for
Running OpenClaw in OpenShell"): insert the two HTML comment SPDX lines
(copyright text and SPDX-License-Identifier) as per project policy so the file
contains the SPDX header in HTML comment form for Markdown files; ensure the
header appears before any other content and follows the same format used across
other docs in the repo.
---
Nitpick comments:
In `@SECURITY.md`:
- Line 8: Rewrite the passive sentences to active voice: replace "If a potential
security issue is inadvertently reported through a public channel, NVIDIA
maintainers may limit public discussion and redirect the reporter to the
appropriate private disclosure channels." with an active-voice version that
names the actor and direct object (for example: "If you inadvertently report a
potential security issue through a public channel, NVIDIA maintainers may limit
public discussion and will redirect you to the appropriate private disclosure
channels."); apply the same change to the related sentence at the other
occurrence (the line referenced as also applies to: 53-53) so both instances use
active voice and address the reporter directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 136fcc91-41d4-4dd4-bd11-a080303539ee
📒 Files selected for processing (3)
README.mdSECURITY.mddocs/index.md
Comment on lines
1
to
3
| <!-- markdownlint-disable MD041 --> | ||
| ## Security | ||
|
|
Contributor
There was a problem hiding this comment.
Add the required SPDX header block at the top of this Markdown file.
This file is missing the required SPDX copyright and license header in HTML comment form.
Proposed fix
+<!--
+ SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ SPDX-License-Identifier: Apache-2.0
+-->
+
<!-- markdownlint-disable MD041 -->
## SecurityAs per coding guidelines, **/*.{js,cjs,mjs,ts,tsx,sh,md} files must include SPDX headers and Markdown files must use HTML comments.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| <!-- markdownlint-disable MD041 --> | |
| ## Security | |
| <!-- | |
| SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| SPDX-License-Identifier: Apache-2.0 | |
| --> | |
| <!-- markdownlint-disable MD041 --> | |
| ## Security | |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@SECURITY.md` around lines 1 - 3, Add an SPDX header HTML comment at the very
top of the Markdown file before the "## Security" heading: insert the required
SPDX copyright and license block (in HTML comment form) as specified by the
coding guidelines so the file includes the SPDX header for Markdown files;
ensure the comment appears above the existing "## Security" line.
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
README.md (1)
1-1:⚠️ Potential issue | 🟠 MajorAdd required SPDX header at the top of this Markdown file.
README.mdis missing the required SPDX license header comments.Proposed fix
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. --> +<!-- SPDX-License-Identifier: Apache-2.0 --> + # 🦞 NVIDIA NemoClaw: Reference Stack for Running OpenClaw in OpenShellAs per coding guidelines, “
**/*.{js,cjs,mjs,ts,tsx,sh,md}: Include SPDX license header at the top of every source file … Use#comments for shell scripts and HTML comments for Markdown files.”🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` at line 1, Add the required SPDX license header as an HTML comment at the very top of README.md (above the "# 🦞 NVIDIA NemoClaw..." title). Insert a one-line or multi-line HTML comment containing the SPDX copyright/text and SPDX-License-Identifier (e.g., SPDX-FileCopyrightText and SPDX-License-Identifier fields) so the Markdown file complies with the project's SPDX header rule.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@README.md`:
- Line 1: Add the required SPDX license header as an HTML comment at the very
top of README.md (above the "# 🦞 NVIDIA NemoClaw..." title). Insert a one-line
or multi-line HTML comment containing the SPDX copyright/text and
SPDX-License-Identifier (e.g., SPDX-FileCopyrightText and
SPDX-License-Identifier fields) so the Markdown file complies with the project's
SPDX header rule.
cv
approved these changes
Mar 31, 2026
laitingsheng
pushed a commit
that referenced
this pull request
Apr 2, 2026
<!-- markdownlint-disable MD041 --> ## Summary Previews: - [README.md#security](https://github.com/NVIDIA/NemoClaw/tree/docs/report-vulnerabilities?tab=readme-ov-file#security) - [SECURITY.md ](https://github.com/NVIDIA/NemoClaw/blob/docs/report-vulnerabilities/SECURITY.md) Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> ## Type of Change <!-- Check the one that applies. --> - [ ] Code change for a new feature, bug fix, or refactor. - [ ] Code change with doc updates. - [x] Doc only. Prose changes without code sample modifications. - [ ] Doc only. Includes code sample changes. ## Testing <!-- What testing was done? --> - [ ] `npx prek run --all-files` passes (or equivalently `make check`). - [ ] `npm test` passes. - [x] `make docs` builds without warnings. (for doc-only changes) ## Checklist ### General - [x] I have read and followed the [contributing guide](https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md). - [x] I have read and followed the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). (for doc-only changes) ### Code Changes <!-- Skip if this is a doc-only PR. --> - [ ] Formatters applied — `npx prek run --all-files` auto-fixes formatting (or `make format` for targeted runs). - [ ] Tests added or updated for new or changed behavior. - [ ] No secrets, API keys, or credentials committed. - [ ] Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs). ### Doc Changes <!-- Skip if this PR has no doc changes. --> - [x] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "`/update-docs` catch up the docs for the new changes I made in this PR." - [ ] New pages include SPDX license header and frontmatter, if creating a new page. - [x] Cross-references and links verified. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Simplified the documentation index table headers and adjusted page entries (e.g., renamed “CLI Reference” to “CLI Commands”). * Expanded the security reporting guidance into a detailed policy with clear "no public issue" instructions and step‑by‑step expectations. * Added explicit private reporting channels (encrypted email, vendor disclosure program, and private GitHub reporting) and clarified required vulnerability details. * Added a “Report Vulnerabilities” resource link and pointers to vendor security bulletins and policies. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
lakamsani
pushed a commit
to lakamsani/NemoClaw
that referenced
this pull request
Apr 4, 2026
<!-- markdownlint-disable MD041 --> ## Summary Previews: - [README.md#security](https://github.com/NVIDIA/NemoClaw/tree/docs/report-vulnerabilities?tab=readme-ov-file#security) - [SECURITY.md ](https://github.com/NVIDIA/NemoClaw/blob/docs/report-vulnerabilities/SECURITY.md) Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> ## Type of Change <!-- Check the one that applies. --> - [ ] Code change for a new feature, bug fix, or refactor. - [ ] Code change with doc updates. - [x] Doc only. Prose changes without code sample modifications. - [ ] Doc only. Includes code sample changes. ## Testing <!-- What testing was done? --> - [ ] `npx prek run --all-files` passes (or equivalently `make check`). - [ ] `npm test` passes. - [x] `make docs` builds without warnings. (for doc-only changes) ## Checklist ### General - [x] I have read and followed the [contributing guide](https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md). - [x] I have read and followed the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). (for doc-only changes) ### Code Changes <!-- Skip if this is a doc-only PR. --> - [ ] Formatters applied — `npx prek run --all-files` auto-fixes formatting (or `make format` for targeted runs). - [ ] Tests added or updated for new or changed behavior. - [ ] No secrets, API keys, or credentials committed. - [ ] Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs). ### Doc Changes <!-- Skip if this PR has no doc changes. --> - [x] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "`/update-docs` catch up the docs for the new changes I made in this PR." - [ ] New pages include SPDX license header and frontmatter, if creating a new page. - [x] Cross-references and links verified. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Simplified the documentation index table headers and adjusted page entries (e.g., renamed “CLI Reference” to “CLI Commands”). * Expanded the security reporting guidance into a detailed policy with clear "no public issue" instructions and step‑by‑step expectations. * Added explicit private reporting channels (encrypted email, vendor disclosure program, and private GitHub reporting) and clarified required vulnerability details. * Added a “Report Vulnerabilities” resource link and pointers to vendor security bulletins and policies. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
gemini2026
pushed a commit
to gemini2026/NemoClaw
that referenced
this pull request
Apr 14, 2026
<!-- markdownlint-disable MD041 --> ## Summary Previews: - [README.md#security](https://github.com/NVIDIA/NemoClaw/tree/docs/report-vulnerabilities?tab=readme-ov-file#security) - [SECURITY.md ](https://github.com/NVIDIA/NemoClaw/blob/docs/report-vulnerabilities/SECURITY.md) Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> ## Type of Change <!-- Check the one that applies. --> - [ ] Code change for a new feature, bug fix, or refactor. - [ ] Code change with doc updates. - [x] Doc only. Prose changes without code sample modifications. - [ ] Doc only. Includes code sample changes. ## Testing <!-- What testing was done? --> - [ ] `npx prek run --all-files` passes (or equivalently `make check`). - [ ] `npm test` passes. - [x] `make docs` builds without warnings. (for doc-only changes) ## Checklist ### General - [x] I have read and followed the [contributing guide](https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md). - [x] I have read and followed the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). (for doc-only changes) ### Code Changes <!-- Skip if this is a doc-only PR. --> - [ ] Formatters applied — `npx prek run --all-files` auto-fixes formatting (or `make format` for targeted runs). - [ ] Tests added or updated for new or changed behavior. - [ ] No secrets, API keys, or credentials committed. - [ ] Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs). ### Doc Changes <!-- Skip if this PR has no doc changes. --> - [x] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "`/update-docs` catch up the docs for the new changes I made in this PR." - [ ] New pages include SPDX license header and frontmatter, if creating a new page. - [x] Cross-references and links verified. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Simplified the documentation index table headers and adjusted page entries (e.g., renamed “CLI Reference” to “CLI Commands”). * Expanded the security reporting guidance into a detailed policy with clear "no public issue" instructions and step‑by‑step expectations. * Added explicit private reporting channels (encrypted email, vendor disclosure program, and private GitHub reporting) and clarified required vulnerability details. * Added a “Report Vulnerabilities” resource link and pointers to vendor security bulletins and policies. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
cv
pushed a commit
that referenced
this pull request
May 13, 2026
## Summary - supersede #3441 with a Docker-driver sandbox reachability probe that mirrors OpenShell's current Docker routing model - inspect the managed Docker network IPAM config, prefer the IPv4 bridge gateway, and inject the same host.openshell.internal mapping real OpenShell sandboxes receive - classify probe setup/DNS/network-inspect failures as non-blocking `probe_unavailable` instead of host-firewall failures - keep the UFW remediation only for native bridge-gateway TCP failures after the exact OpenShell route has been modeled ## Why #3441 tried to catch the real partner/Brev failure from #3439, but its helper container did not actually behave like an OpenShell Docker sandbox after OpenShell #1128. Real sandboxes get explicit `host.openshell.internal` routing: native Linux Docker maps it to the `openshell-docker` bridge gateway IP, while Docker Desktop/VM-backed Docker uses Docker's `host-gateway` route. This replacement keeps the useful early diagnostic while avoiding the false DNS/host-gateway failures that forced the #3441 revert. ## Validation - npm run build:cli - npm run typecheck:cli - npx vitest run src/lib/onboard/gateway-sandbox-reachability.test.ts test/gateway-liveness-probe.test.ts - npm run checks - git diff --check Local Docker note: this checkout did not have an `openshell-docker` network, which now maps to `probe_unavailable` / continue rather than a firewall diagnosis. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Docker gateway startup now performs sandbox-bridge reachability checks before reporting healthy, reducing startup surprises. * **User-facing** * Clearer diagnostics and guidance when sandbox-to-gateway connectivity fails (including conditional firewall hints for TCP failures). * **Tests** * Added tests covering gateway reachability checks and related messaging to prevent regressions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/3459) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Previews:
Signed-off-by: Miyoung Choi miyoungc@nvidia.com
Type of Change
Testing
npx prek run --all-filespasses (or equivalentlymake check).npm testpasses.make docsbuilds without warnings. (for doc-only changes)Checklist
General
Code Changes
npx prek run --all-filesauto-fixes formatting (ormake formatfor targeted runs).Doc Changes
update-docsagent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docscatch up the docs for the new changes I made in this PR."Summary by CodeRabbit