Skip to content

docs: add SECURITY.md for vulnerability disclosure process #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Nivesh353 wants to merge 1 commit into
base: main
Choose a base branch
from
+33 −0
Open

docs: add SECURITY.md for vulnerability disclosure process #79

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
# Security Policy

## Supported Versions

Security fixes are applied to the latest released version on `main`. Older versions are not backported.

## Reporting a Vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Instead, use one of the following private channels:

1. **GitHub Private Vulnerability Reporting** (preferred) — go to the **Security** tab on this repository and select **Report a vulnerability**.
2. **Email** — [shreyas@lyzr.ai](mailto:shreyas@lyzr.ai). A PGP key is available on request for encrypted reports.

Please include as much detail as possible:

- A description of the vulnerability and its potential impact
- Steps to reproduce, or a proof-of-concept if available
- Affected version/commit
- Any suggested mitigation, if known

## Response SLA

- **Acknowledgment:** within 3 business days of report.
- **Initial assessment:** within 7 business days, including severity and next steps.
- **Fix or mitigation timeline:** communicated once the report is triaged, based on severity.

We'll keep you updated as the report is investigated, and credit reporters (unless anonymity is requested) once a fix is released.

## Scope

This policy covers the `gitagent` CLI, SDK, and runtime in this repository. Vulnerabilities in third-party dependencies should be reported upstream, but feel free to flag them here as well if they materially affect gitagent users.