Post

You're Microsoft, you shouldn't be talking about security

Tens of thousands of smart, dedicated engineers work at MSFT. Don't confuse the decisions of their exec team with the efforts of their rank and file.

Dedicated engineers forced to work on a sprawling, spaghetti codebase plagued by a history of major security exploits and questionable API design choices. Their efforts would be better spent contributing to a real operating system instead. David Cutler would be spinning in his grave if he was dead.

1. Add a SECURITY. md file Tell researchers how to report vulnerabilities privately, what’s in scope, and what information to include. Without clear guidance, a well-meaning reporter may resort to a public issue or struggle to reach you at all.

2. Enable private vulnerability reporting Give researchers a confidential place to report vulnerabilities directly in your repository. You can triage the report privately, collaborate on a fix, and disclose it on your timeline.

3. Turn on secret scanning with push protection Millions of secrets are exposed in public repositories every year. Secret scanning detects leaked credentials. Push protection helps stop API keys and tokens before they enter your repository.