From d57fbb10951cf0f52c9c2b7ef4464c60cb5f74a2 Mon Sep 17 00:00:00 2001 From: stxkxs <139715017+stxkxs@users.noreply.github.com> Date: Tue, 18 Aug 2026 23:59:30 -0700 Subject: [PATCH] Add issue templates that route disclosure away from public threads MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The repository is public with issues enabled and had no templates, so the default path for a reporter was a blank public issue — including for the one class of report that must never be filed publicly. SECURITY.md and CONTRIBUTING.md already say that anything touching provenance or personal data goes through a private advisory. That instruction only works if the reader finds it before filing, and nothing enforced it at the moment of filing. These templates move the rule to the point of decision. ──────────────────────── config.yml ──────────────────────── `blank_issues_enabled: false`, so every report starts from a form rather than an empty box. Two contact links sit above the form: - A private-disclosure route to GitHub security advisories, worded for what actually matters here — a forged or missing citation, a wrong retrieval timestamp, or anything involving personal data. This is the redirect that does the real work: it appears before the reporter can paste a finding into a public thread. - An upstream-data route, because "the government source published something wrong" is a coverage caveat rather than a citature bug, and a reporter has no way to know that in advance. ───────────────────────── bug.yml ───────────────────────── Opens with the stop-and-report-privately notice, repeated at the top of the form on the assumption that a reporter skipped the contact links. Fields are shaped around how this product actually fails: which tool or actor, the exact input, expected versus actual, and — optional but the most useful field on the form — the receipt envelope. The citation, `retrieved_at`, and match provenance name the upstream file an answer came from, which is usually the shortest path to a cause. A source dropdown tags FEC / USASpending / SAM.gov / Grants.gov, since those have genuinely different upstream cadences and a report that looks like staleness is often correct behaviour on a two-year publication cycle. The input field says to redact nothing: these are public records by law, and a redacted repro is harder to act on for no privacy gain. ────────────────────────── Reach ────────────────────────── Same limit as the other health files: GitHub applies defaults from a .github repository to PUBLIC repositories. The only other repository in the org is private, so the immediate reach is this one. Co-authored-by: stxkxsbot <275011021+stxkxsbot@users.noreply.github.com> --- .github/ISSUE_TEMPLATE/bug.yml | 64 +++++++++++++++++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 16 ++++++++ 2 files changed, 80 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/bug.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..4d8661e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,64 @@ +name: Bug report +description: Something returned the wrong answer, failed, or contradicted its own receipt. +labels: ["bug"] + +body: + - type: markdown + attributes: + value: >- + **Stop if this involves provenance or personal data.** A forged or + missing citation, a wrong `retrieved_at`, or anything exposing an + individual person is a security issue — report it privately through + [security advisories](https://github.com/citature/.github/security/advisories/new) + rather than here. Everything else belongs in this form. + + - type: input + id: surface + attributes: + label: Tool or actor + description: The MCP tool name or the Apify actor, as you called it. + placeholder: follow_the_money · govcon-recompetes + validations: + required: true + + - type: textarea + id: input + attributes: + label: What you ran + description: The exact arguments or actor input. Redact nothing — these are public records. + render: json + validations: + required: true + + - type: textarea + id: expected + attributes: + label: What you expected, and what you got instead + validations: + required: true + + - type: textarea + id: receipt + attributes: + label: The receipt + description: >- + Paste the receipt envelope from the answer if you have it — the citation, + `retrieved_at`, and match provenance. It is usually the fastest route to + the cause, because it says which upstream file the answer came from. + render: json + validations: + required: false + + - type: dropdown + id: source + attributes: + label: Which source does this touch? + multiple: true + options: + - FEC + - USASpending + - SAM.gov + - Grants.gov + - Not sure + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..cdd0677 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,16 @@ +blank_issues_enabled: false + +contact_links: + - name: Vulnerability, provenance, or personal-data concern — report privately + url: https://github.com/citature/.github/security/advisories/new + about: >- + Do not open a public issue. Anything that could let a citation, retrieval + timestamp, or source locator be forged, and anything involving personal + data, goes here privately. See SECURITY.md for scope. + + - name: Incorrect data in a federal source + url: https://github.com/citature/.github/issues/new?template=bug.yml + about: >- + If a government source itself published something wrong, that is an + upstream data issue rather than a citature bug. File it as a bug report + and it will be documented as a coverage caveat.