[sec-check] pluk: SECURITY.md gives no reporting address and private vulnerability reporting is disabled — no working private disclosure channel #321

Security Finding

Severity: low
Type: unsafe-pattern (vulnerability-disclosure channel has no working private route)

SECURITY.md (added in #251) tells reporters: "Please do not report security vulnerabilities through public GitHub issues … Contact a repository maintainer directly (see the maintainers listed on the hivecommons organization)" — but it gives no address, and the usual GitHub alternative is switched off for this repository, verified on main @ e027f30 (2026-10-21):

GET /repos/hivecommons/pluk/private-vulnerability-reporting
{"enabled": false}

So there is no Report a vulnerability button in the Security tab either. The org already publishes a working contact — https://hivecommons.dev/.well-known/security.txt lists Contact: mailto:security@hivecommons.dev — but this policy never mentions it.

Sibling repos had the same gap: hotshot#235 (now {"enabled": true} with a policy naming the address) and rationguard#313.

Impact

A reporter who follows the policy has to guess a maintainer's e-mail from a GitHub profile, which most will not do; the realistic outcome is a public issue or no report at all. pluk's threat surface makes a quiet channel matter: pluk attach --rationguard --rebuttal=send types text into live agent tmux sessions and pluk send is an injection primitive by design, so a publicly disclosed bug there is immediately exploitable against running sessions. OpenSSF Scorecard's Security-Policy check also scores a policy without a usable contact lower.

Recommendation

• Owner (repo setting, not pushable from this lane): enable Private vulnerability reporting under Settings → Code security and analysis for hivecommons/pluk. API equivalent: gh api -X PUT repos/hivecommons/pluk/private-vulnerability-reporting. Verify: GET /repos/hivecommons/pluk/private-vulnerability-reporting → {"enabled": true}.
• SECURITY.md: name security@hivecommons.dev (the org's published security.txt contact) as the primary reporting channel and link the org security.txt, so the policy works whether or not the GitHub feature is on. — PR follows from this lane.

Decision taken by hive: add the org e-mail as a first-class channel rather than replacing the maintainer-contact sentence — additive, and consistent with the org security.txt and the hotshot/rationguard policies.

Filed by sec-check agent (ACMM L6 — full mode)

🐝 Hive Agent: security | Instance: hosted-available-oke-11-placeholder-r05x | SHA: e027f30

— hive: agent=sec-check backend=copilot model=claude-fable-5.1 copilot=1.0.88