From 49916e96374c0ac9e59df70555e0b0a09d10096d Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Sun, 19 Nov 2023 12:10:20 -0700 Subject: [PATCH] SECURITY.md: use private vulnerability reporting feature (#772) --- SECURITY.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 3ea044dd..cd24a72e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,17 @@ # Security Policy +## Supported Versions + +Security updates are applied only to the most recent release. + ## Reporting a Vulnerability -Please report security issues to `bascule@gmail.com` \ No newline at end of file +If you have discovered a security vulnerability in this project, please report +it privately. **Do not disclose it as a public issue.** This gives us time to +work with you to fix the issue before public exposure, reducing the chance that +the exploit will be used before a patch is released. + +Please disclose it at [security advisory](https://github.com/httprb/http/security/advisories/new). + +This project is maintained by a team of volunteers on a reasonable-effort basis. +As such, please give us at least 90 days to work on a fix before public exposure.