From 60e3e175429597bac261787baedbda04eed94551 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Fri, 17 Jul 2026 11:01:56 +0200 Subject: [PATCH 1/2] Update SECURITY.md for clarity on support and reporting Clarified security policy regarding supported versions and vulnerability reporting. --- SECURITY.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..bfd5bca --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,32 @@ +# Security Policy + +## Supported Versions + +Only the latest published version of this project is supported with security updates. + +Older versions are not supported. If a vulnerability affects an older version, please first verify whether it is still present in the latest version. + +## Reporting a Vulnerability + +If you discover a security vulnerability, please report it through **GitHub Security Advisories** using private vulnerability reporting. + +- Go to the repository’s **Security** tab. +- Choose **Report a vulnerability**. +- Submit the details privately through GitHub’s advisory workflow. + +Please **do not** open public issues for security vulnerabilities. + +## What to Include in a Report + +To help us triage and fix issues quickly, please include: + +- A clear description of the vulnerability +- Steps to reproduce +- A proof of concept (if available) +- Impact assessment +- Suggested remediation (if known) + +## Response Process + +We will review reports and assess impact/severity. +If the report is accepted, a fix will be developed and released in the latest supported version, and a coordinated disclosure will be made through GitHub Security Advisories. From f51dbdb8f99202580dc2a25139ca2e7c5beb712b Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Fri, 17 Jul 2026 11:05:06 +0200 Subject: [PATCH 2/2] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jan Kowalleck --- SECURITY.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index bfd5bca..29c242a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -13,6 +13,8 @@ If you discover a security vulnerability, please report it through **GitHub Secu - Go to the repository’s **Security** tab. - Choose **Report a vulnerability**. - Submit the details privately through GitHub’s advisory workflow. +- + Please **do not** open public issues for security vulnerabilities. @@ -28,5 +30,6 @@ To help us triage and fix issues quickly, please include: ## Response Process -We will review reports and assess impact/severity. +We will review reports and assess impact/severity. + If the report is accepted, a fix will be developed and released in the latest supported version, and a coordinated disclosure will be made through GitHub Security Advisories.