Security policy coverage across scanned projects
rob1ham-2085477372938060221
- Author
- @Rob1Ham
- Organisation
- independent
- Evidence role
- social statement
- Posted
- 6 Aug 2026, 21:25 UTC
- Capture status
- capture held
Rob Hamilton urges projects that touch people's money to publish a SECURITY.md, quoting calle's post that outreach is the campaign's biggest bottleneck. The quoted card carries the measurement behind the plea, taken over 426 reviewed projects: 19.5 per cent publish a SECURITY.md, 13.1 per cent expose an extractable security email, 28 route through GitHub advisories or a bug bounty with no email, and 342 have no published policy at all. That figure for how reachable bitcoin projects are for disclosure is the reason to hold this rather than the exhortation, and it is one of the few Red Team outputs stated as a proportion rather than a count of findings. Hamilton co-leads the campaign that produced the numbers and the underlying dataset is not published. The figures are the campaign's own and are not checked here.
This post is registered as evidence and has a locally held capture. The original remains the canonical publication. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.