No SECURITY.md: the published security policy is unreachable from the repo

[johnhenry]

Summary

T3 Code has a real, well-written security policy — apps/marketing/src/pages/security-policy.astro, published at /security-policy, with a reporting address (security@ping.gg), stated acknowledgement targets, and an explicit safe harbor for good-faith research.

None of that is reachable from this repository. A researcher who lands on github.com/pingdotgg/t3code finds no pointer to it.

Details

GitHub surfaces a repo's security policy — the "Security" tab, and the Report a vulnerability affordance — from exactly three paths. All three are absent:

path	present
SECURITY.md	no
.github/SECURITY.md	no
docs/SECURITY.md	no

There is also no .well-known/security.txt on the marketing site, and no occurrence of security@ping.gg anywhere in the repo:

$ grep -rn "security@ping.gg" --include='*.md' --include='*.yml' .
(no matches)

The policy page itself is linked only from the site's own footer, /legal, and the Terms of Service — all on the marketing site, none from the repo.

CONTRIBUTING.md is the natural fallback a reporter would read, and it says "You can still report a bug or open a PR, but please do so knowing there is a high chance we close it, defer it forever, or never look at it." For someone holding a security finding, that reads as "the public issue tracker is the only channel and it may be ignored" — which is the opposite of what your policy actually offers them.

Impact

The gap is discovery, not policy. Someone who finds a vulnerability is most likely to be reading the source, so the repo is where they will look for the channel. Without a pointer, the paths of least resistance become a public issue or a public discussion — the outcome the policy's own "please do not disclose the issue publicly" clause is written to prevent.

Suggested fix

A short .github/SECURITY.md pointing at the canonical policy would close it:

# Security Policy

Please report security vulnerabilities to security@ping.gg — not via
public issues or discussions.

Full policy, including scope and safe harbor for good-faith research:
https://t3.codes/security-policy

That alone lights up the Security tab and the "Report a vulnerability" button. A .well-known/security.txt on the marketing site would cover the automated-scanner path too.

Related, smaller

docs/internals/t3-code-connect-auth-flow.html contains the substantive security thinking for T3 Connect — "Security Invariant", "Authentication and Transport Matrix", "Credential Ownership", "SSRF and Tunnel Hardening", "Standards References". It is linked from docs/internals/t3-connect.md and infra/relay/README.md, so it is not hidden exactly, but it is the only raw .html file in a docs tree that is otherwise Markdown, and nothing from the README or the security policy points to it. If any part of it is meant as a public statement of the threat model, it is currently addressed only to people already reading relay internals.

---

Noting CONTRIBUTING.md routes proposals to Ideas Discussions — happy to move this there if you would rather. Filing it here because it concerns the vulnerability-reporting channel itself.