This repo is the home of the SECOM specification.
Security Commits (SECOM) is a small specification for commit messages that make security-relevant changes visible and machine-readable. It defines how to annotate commits that introduce, fix, or otherwise impact security-related behaviour in your codebase.
SECOM is inspired by the Conventional Commits specification: it reuses familiar concepts and syntax from Conventional Commits, but focuses specifically on surfacing security information that downstream tools and humans can reliably consume.
- Visibility of security changes: Make it obvious when a commit has security impact (for example, when a vulnerability is fixed or a risky change is introduced).
- Machine-readable metadata: Provide a predictable, parseable format for security-related commit information so that tooling, monitoring, and advisory systems can build on top of it.
- Compatibility with Conventional Commits: Stay as close as possible to existing Conventional Commits workflows so that projects can adopt SECOM incrementally without rewriting their entire commit message culture.
We'd love your help refining the language of this specification or fixing typos. Please don't hesitate to open an issue or send a pull request.
If you want to propose a change to the SECOM specification itself, we recommend:
- Opening a GitHub issue in this repository to describe the problem you are trying to solve and any prior art you are aware of (including how it relates to Conventional Commits, if relevant).
- Following up with a pull request that updates the relevant specification and site content files in this repository, keeping changes as small and focused as possible.
This site is built with Vite and React.
-
Install dependencies:
npm install
-
Start the development server:
npm run dev
-
Open the URL printed in the terminal (by default,
http://localhost:5173) to view the site.
To build the production assets, run:
npm run buildTo preview the production build locally, run:
npm run previewThe SECOM specification is maintained in this repository. Changes to the spec are proposed and discussed via GitHub issues and pull requests.
- Discussion first: For non-trivial or potentially breaking changes, we encourage starting with an issue to build shared understanding before opening a pull request.
- Review by maintainers: Project maintainers review proposals with a focus on clarity, real-world usability, and keeping SECOM as compatible as reasonably possible with Conventional Commits.
- Preference for incremental evolution: We value small, well-motivated changes over large, speculative redesigns.
The contents of this repository, including the SECOM specification text, are
licensed as described in the LICENSE file in the root of this
repository.
Tell your users that you use the SECOM specification:
[](https://security-commits.org)Thank you for your interest in Security Commits and for helping improve the ecosystem around security-relevant changes. Inspired by Conventional Commits.
