Create SECURITY.MD for security policy and reporting

Added a security policy document outlining supported versions and vulnerability reporting procedures.
2026-08-11 08:14:41 +01:00
parent c5805a0c7f
commit 32ed120c57
1 changed files with 51 additions and 0 deletions
@@ -0,0 +1,51 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are provided for actively maintained versions of this project.
+
+| Version | Supported |
+| ------- | --------- |
+| Latest release | :white_check_mark: |
+| Older releases | :x: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it responsibly.
+
+Please do not disclose security vulnerabilities publicly through GitHub Issues, Pull Requests, or other public channels before the maintainers have had an opportunity to investigate.
+
+### How to Report
+
+Please use GitHub's private vulnerability reporting feature for this repository if it is available.
+
+If private vulnerability reporting is not available, contact the project maintainers through the repository's official GitHub channels and clearly identify the report as a security vulnerability.
+
+Please include:
+
+- A clear description of the vulnerability
+- The affected component, file, or feature
+- Steps to reproduce the issue
+- The potential security impact
+- Any proof-of-concept or relevant logs, if available
+- A suggested mitigation or fix, if you have one
+
+### What to Expect
+
+After receiving a vulnerability report, maintainers should:
+
+1. Acknowledge receipt of the report.
+2. Investigate and validate the reported issue.
+3. Determine the severity and affected versions.
+4. Develop and test an appropriate fix.
+5. Release or communicate the fix when appropriate.
+
+Please allow reasonable time for investigation and remediation before publicly disclosing the vulnerability.
+
+## Responsible Disclosure
+
+We appreciate responsible security research and coordinated disclosure.
+
+Security researchers are encouraged to avoid accessing, modifying, or deleting data belonging to others and to avoid actions that could disrupt services or users.
+
+Thank you for helping improve the security of this project.