docs: point security reports at Bugcrowd in the PR template - #174
Merged
Conversation
Adds one line to the template's leading HTML comment so a contributor sees it while writing the PR and does not file a vulnerability in public. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Coverage Report for CI Build 32599153900Coverage decreased (-11.2%) to 53.427%Details
Uncovered ChangesNo uncovered changes found. Coverage Regressions164 previously-covered lines in 9 files lost coverage.
Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The template already keeps its guidance inside HTML comments, so none of it leaks into contributor PR bodies. What it does not say is where to send a security report, and a vulnerability filed as a public pull request or issue is disclosed the moment it is opened.
Solution
One line added to the leading comment block, pointing at https://bugcrowd.com/engagements/opensea. Nothing else changes, and the rendered template is still just the Motivation and Solution headings.
Part of a sweep across the public OpenSea repos. The mirrored packages in opensea-devtools had the opposite problem: their template was plain markdown rather than a comment, so every community PR body opened with our own boilerplate. See opensea-sdk pull requests 1997 through 2000, all opened the same day, each beginning with "Thanks for opening a PR" before the author gets a word in.
Verified by stripping the HTML comments from the file and confirming the remainder is two headings and blank lines.
CI status
The four Forge jobs are red, and they were red before this branch existed. They fail in
Install forge dependencies, before a single contract compiles:.gitmodulespinslib/forge-stdwithbranch = v1.5.0, but v1.5.0 is a tag upstream, not a branch, and the Foundry nightly these workflows install can no longer resolve it from its shallow clone. The tag itself still exists at foundry-rs/forge-std, so this is toolchain drift rather than a deleted ref.Every Seaport Test CI and seadrop Test CI run going back months has failed the same way, including dependabot branches that change nothing but a lockfile. Seaport's own main at 08013390, the base of this branch, failed on 2025-09-30. The Hardhat jobs, linters, CodeQL and Socket all pass here.
A markdown file cannot affect
forge install. Repinning forge-std or freezing the Foundry version belongs in its own PR, since it touches the toolchain for an audited contract repo.