Skip to content

Add security policy #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hexuria wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add security policy #42

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Security policy

## Reporting a vulnerability

Please report security issues privately. Do not open a public issue, discussion or pull request
for a vulnerability.

1. **Preferred: GitHub private vulnerability reporting.**
Open a private report at <https://github.com/hexuria/box/security/advisories/new>
(repository **Security** tab → **Report a vulnerability**). The report stays private between you
and the maintainer until a fix is published.
2. **Email:** codeitlikemiley@gmail.com (Uriah Galang, maintainer), if you cannot use GitHub.

Please include:

- the affected commit (or "latest `main`"),
- steps or a proof of concept to reproduce,
- the impact you observed or expect.

You should get an acknowledgement within 7 days. Please give us a reasonable time to fix the issue
before any public disclosure.

## Supported versions

| Version | Supported |
| --- | --- |
| latest commit on `main` | yes |
| anything older | no |

Fixes land on `main`; there are no maintained release branches.

## Automated scanning

Reports from automated scanners (for example Anthropic's OSS Scanner) go to the same address above.
Loading