[PR] fix(security-issue-sync): credit scanner findings as tool, not anonymous [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1124:
URL: https://github.com/apache/magpie/pull/1124

   ## Summary
   
   - The `security-issue-sync` anonymise gate contradicts the framework's own bot-credits policy: `tools/cve-tool-vulnogram/bot-credits-policy.md` says automation that surfaces a real vulnerability is credited `type: "tool"`, but the gate replaces the credit with `anonymous`.
   - Splits the two concerns the gate conflated — suppressing an un-consenting individual, and withholding a vendor's commercial product name — from a third it never needed to do: erasing the fact that a tool made the discovery.
   - Adds a `Public credit name` column to the `scanner-products.md` template so the public-safe name of the scanning tooling is declared separately from the confidential product token.
   
   ## Motivation
   
   Found while reconciling a downstream adopter's override against the framework default. The adopter had independently rewritten this rule after the `anonymous` behaviour produced **44 CVE records carrying a bogus `anonymous` finder credit** — findings that a scanning tool had genuinely discovered and that the CVE 5.x schema has an exact category for.
   
   The confidentiality goal is sound and unchanged. The product token still never reaches a public surface, and the audit-trail surfaces (mailing-list thread field, status rollup, mail thread) stay untouched. What changes is only *what replaces* the suppressed name.
   
   ## Migration path
   
   Backwards-compatible. The new column is optional: an adopter who leaves it blank keeps today's `anonymous` behaviour exactly. Adopters opt in by declaring a public credit name per scanner. No skill step is renumbered and no anchor moves.
   
   ## Test plan
   
   - `prek run --files <the three changed files>` — all hooks pass, including `markdownlint`, `check-placeholders`, and `skill-and-tool-validate`.
   - `lychee --config .lychee.toml --offline` over the changed files — 77 links OK, 0 errors; the in-hook lychee also passes.
   - Anchor check: the three files' cross-references to `bot-credits-policy.md` resolve, and the `Step 5b 1b` back-reference from `gather.md` is unchanged.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(security-issue-sync): credit scanner findings as tool, not anonymous [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1124:
URL: https://github.com/apache/magpie/pull/1124


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org