Skip to content

Adding Microsoft SECURITY.MD#1

Closed
microsoft-github-policy-service[bot] wants to merge 1 commit into
mainfrom
users/GitHubPolicyService/a64ac8c0-7637-4c59-becb-6b8d38faaff1
Closed

Adding Microsoft SECURITY.MD#1
microsoft-github-policy-service[bot] wants to merge 1 commit into
mainfrom
users/GitHubPolicyService/a64ac8c0-7637-4c59-becb-6b8d38faaff1

Conversation

@microsoft-github-policy-service

Copy link
Copy Markdown

Please accept this contribution adding the standard Microsoft SECURITY.MD 🔒 file to help the community understand the security policy and how to safely report security issues. GitHub uses the presence of this file to light-up security reminders and a link to the file. This pull request commits the latest official SECURITY.MD file from https://github.com/microsoft/repo-templates/blob/main/shared/SECURITY.md.

Microsoft teams can learn more about this effort and share feedback within the open source guidance available internally.

@mrunalhirve128 mrunalhirve128 added P1 Very high priority enhancement New feature or request security Security-related issue labels Feb 5, 2026
@mrunalhirve128

Copy link
Copy Markdown
Contributor

🤖 Team Assistant Triage

This issue has been automatically analyzed and triaged.

AI Decision Reasoning: Type: Classified as 'feature' because the issue proposes adding a new file that enhances the project's security documentation.
Priority: Elevated to P1 due to security concern: Security keywords detected: security, RCE
Copilot: Security issues require human review and should not be auto-fixed
Assignment: Security issue assigned to security lead. Security keywords detected: security, RCE
Labels: Applied labels enhancement, P1, security based on issue type and priority

Labels and assignee have been applied based on this analysis.

sellakumaran added a commit that referenced this pull request Mar 11, 2026
- Delegate zip creation to ManifestTemplateService.CreateManifestZipAsync,
  removing duplicate inline implementation and aligning file list with the
  service's canonical set (fixes comments #1 and #2)
- Move per-file zip log entries to LogDebug in ManifestTemplateService so
  the command output remains terse
- Fix --dry-run option description: "without writing files or creating the zip"
  (fixes comment #3)
- Handle null/empty displayName in name.short guidance with explicit warning
  instead of printing currently: "" (fixes comment #4)
- Update test class summary to reflect current Console.In redirect approach
  (fixes comment #6)
- Fix CHANGELOG: interactive prompts occur only in interactive terminals;
  stdin redirect suppresses them in scripts (fixes comment #7)
- Comment #5 (PowerPlatformConstants summary) already resolved by prior rename

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
sellakumaran added a commit that referenced this pull request Mar 11, 2026
… instructions (#315)

* fix: strip publish command to zip-only and remove internal MOS constants

- PublishCommand now only updates manifest files, creates manifest.zip,
  and prints manual upload instructions (Agents > All agents > Upload custom agent)
- Removed MOS Titles upload, token acquisition, and Graph API steps from publish
- Removed --mos-env, --mos-token, --skip-graph options
- Deleted AgentPublishService, MosTokenService, PublishHelpers (dead code)
- Stripped MosConstants to PowerPlatform-only; removed internal TPS/MOS Titles
  app IDs, scope GUIDs, and service URLs
- Removed dead MOS error message helpers from ErrorMessages
- Updated PublishCommandTests to match new simplified signature and added
  zip creation test

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor: address code review issues in publish command cleanup

- Remove unused agentBlueprintService parameter from CreateCommand signature
  and its callsite in Program.cs (CR-001)
- Replace magic-number zip cap (4) and arbitrary file padding loop with a
  clean LINQ expression over known candidate filenames (CR-002)
- Remove dead --verbose option binding in publish command handler; startup-
  level --verbose in Program.cs continues to work (CR-003)
- Add CHANGELOG [Unreleased] entry for the breaking behavior change (CR-004)
- Remove redundant Console.SetIn call inside zip creation test; constructor
  already sets it (CR-005)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: resolve post-merge build errors from main refactoring

- Update Program.cs to use AzureAuthValidator directly (replaces removed
  IAzureValidator/AzureValidator), remove AzureWebAppCreator resolution,
  and pass authValidator to CleanupCommand
- Delete MosPrerequisitesRequirementCheck and its test — this check wraps
  the deleted PublishHelpers and is no longer needed after the publish
  command was stripped to zip-only

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor: clean up publish command output to follow az cli conventions

- Replace verbose section headers and wall-of-text guidance with a terse
  column-aligned field list (version, name.short, name.full, descriptions,
  developer.*, icons)
- Remove duplicate success messages; single 'Manifest updated: {path}' line
- Move per-file zip log entries to LogDebug
- Remove mixed Console.WriteLine / logger calls; output consistent through logger
- Add blank line after interactive prompt block before 'Package created:'
- Fix column alignment: replace 'color.png / outline.png' key with 'icons'
- Add name.short > 30 char warning
- Remove unused logger parameters from UpdateManifestFileAsync and
  UpdateAgenticUserManifestTemplateFileAsync
- Update tests: remove Console.SetIn workarounds that are no longer needed
  for early-exit paths; add WithDisplayNameExceeding30Chars_LogsWarning test

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* rename: MosConstants -> PowerPlatformConstants

File and class name no longer reflect their contents after MOS upload
infrastructure was removed. The remaining constants relate solely to the
Power Platform API (CopilotStudio permissions), so rename to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: address PR #315 review comments

- Delegate zip creation to ManifestTemplateService.CreateManifestZipAsync,
  removing duplicate inline implementation and aligning file list with the
  service's canonical set (fixes comments #1 and #2)
- Move per-file zip log entries to LogDebug in ManifestTemplateService so
  the command output remains terse
- Fix --dry-run option description: "without writing files or creating the zip"
  (fixes comment #3)
- Handle null/empty displayName in name.short guidance with explicit warning
  instead of printing currently: "" (fixes comment #4)
- Update test class summary to reflect current Console.In redirect approach
  (fixes comment #6)
- Fix CHANGELOG: interactive prompts occur only in interactive terminals;
  stdin redirect suppresses them in scripts (fixes comment #7)
- Comment #5 (PowerPlatformConstants summary) already resolved by prior rename

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request P1 Very high priority security Security-related issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants