| name | coordinate-a-security-release |
| description | Run a coordinated security release for a privately-reported vulnerability — private fix branch, GHSA/CVE assignment, patched versions on every supported line, an advisory, and disclosure timing. Returns the coordinated-release runbook and the advisory skeleton. The vulnerability ANALYSIS routes to security-engineering; this skill owns the release choreography. Shared by both agents. |
Skill: coordinate-a-security-release
Invoked by: release-and-versioning-engineer and oss-maintainer-strategist (shared).
When to invoke: a vulnerability arrives via the private channel; a SECURITY.md report needs handling; a public issue accidentally disclosed a vuln.
Output: the coordinated-release runbook + an advisory skeleton + disclosure timing.
Boundary: this skill owns the release choreography. The vulnerability analysis (is it exploitable? what's the CVSS? what's the blast radius?) routes to security-engineering/security-reviewer.
The runbook (coordinated disclosure)
- Receive privately, acknowledge fast. Confirm via the
SECURITY.md channel within the stated SLA. Never discuss specifics in a public issue/PR. If it leaked into a public issue, minimize it (lock/redact) and move to private.
- Triage severity (with security-engineering). Confirm it's real, score it (CVSS), and determine which versions/lines are affected.
- Fix in private. Work on a private fork / GitHub Security Advisory draft workspace — a fix in
main with a telling message before the advisory is a 0-day handed to attackers.
- Reserve the identifier. Open a GHSA (GitHub Security Advisory); request a CVE through it. Keep it in draft.
- Prepare patched releases for every supported line. Backport the fix to each line within the support window (see
manage-breaking-changes-and-deprecations). Pre-stage the version bumps and ### Security changelog entries.
- Set the disclosure timeline. Coordinate with the reporter; the common default is up to 90 days, shortened if actively exploited. Notify major downstreams ahead of public disclosure when warranted.
- Release + disclose together. Publish the patched versions, publish the advisory (GHSA → CVE), credit the reporter, and post the upgrade guidance. The fix becoming public and the advisory becoming public happen at the same moment.
Advisory skeleton
Title: <component> <vuln class> (CVE-YYYY-NNNNN / GHSA-xxxx)
Severity: <CVSS vector + score> Affected: <version ranges> Patched: <versions>
Summary: <what an attacker can do, plainly>
Workaround: <if any, before upgrading>
Credit: <reporter> Timeline: reported <date> -> fixed <date> -> disclosed <date>
Guardrails
- Private first, always — see
../../best-practices/security-reports-go-private-first.md. A public fix commit before disclosure is the cardinal error.
- Patch every supported line, not just
main — users on older supported majors are the most exposed.
- Credit the reporter unless they decline — it's the social contract that keeps reports coming privately.
- The analysis is not yours — route exploitability/scoring to
security-engineering; you own the release choreography and the advisory.
