From f49eb04b0586c5d492ad0e7777cae63a892bab6a Mon Sep 17 00:00:00 2001 From: hexuria <295542929+hexuria@users.noreply.github.com> Date: Tue, 20 Oct 2026 08:50:12 +0800 Subject: [PATCH] Add security policy SECURITY.md: private vulnerability reporting preferred, codeitlikemiley@gmail.com fallback, latest main supported. --- SECURITY.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d2243d1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,34 @@ +# Security policy + +## Reporting a vulnerability + +Please report security issues privately. Do not open a public issue, discussion or pull request +for a vulnerability. + +1. **Preferred: GitHub private vulnerability reporting.** + Open a private report at + (repository **Security** tab → **Report a vulnerability**). The report stays private between you + and the maintainer until a fix is published. +2. **Email:** codeitlikemiley@gmail.com (Uriah Galang, maintainer), if you cannot use GitHub. + +Please include: + +- the affected commit (or "latest `main`"), +- steps or a proof of concept to reproduce, +- the impact you observed or expect. + +You should get an acknowledgement within 7 days. Please give us a reasonable time to fix the issue +before any public disclosure. + +## Supported versions + +| Version | Supported | +| --- | --- | +| latest commit on `main` | yes | +| anything older | no | + +Fixes land on `main`; there are no maintained release branches. + +## Automated scanning + +Reports from automated scanners (for example Anthropic's OSS Scanner) go to the same address above.