From 32ed120c570e8015171150e9e21486adba0ec521 Mon Sep 17 00:00:00 2001 From: Cupid Navaz <100488120+cupidnavaz@users.noreply.github.com> Date: Tue, 11 Aug 2026 08:14:41 +0100 Subject: [PATCH 1/2] Create SECURITY.MD for security policy and reporting Added a security policy document outlining supported versions and vulnerability reporting procedures. --- SECURITY.MD | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 SECURITY.MD diff --git a/SECURITY.MD b/SECURITY.MD new file mode 100644 index 0000000..d04547e --- /dev/null +++ b/SECURITY.MD @@ -0,0 +1,51 @@ +# Security Policy + +## Supported Versions + +Security updates are provided for actively maintained versions of this project. + +| Version | Supported | +| ------- | --------- | +| Latest release | :white_check_mark: | +| Older releases | :x: | + +## Reporting a Vulnerability + +If you discover a security vulnerability in this project, please report it responsibly. + +Please do not disclose security vulnerabilities publicly through GitHub Issues, Pull Requests, or other public channels before the maintainers have had an opportunity to investigate. + +### How to Report + +Please use GitHub's private vulnerability reporting feature for this repository if it is available. + +If private vulnerability reporting is not available, contact the project maintainers through the repository's official GitHub channels and clearly identify the report as a security vulnerability. + +Please include: + +- A clear description of the vulnerability +- The affected component, file, or feature +- Steps to reproduce the issue +- The potential security impact +- Any proof-of-concept or relevant logs, if available +- A suggested mitigation or fix, if you have one + +### What to Expect + +After receiving a vulnerability report, maintainers should: + +1. Acknowledge receipt of the report. +2. Investigate and validate the reported issue. +3. Determine the severity and affected versions. +4. Develop and test an appropriate fix. +5. Release or communicate the fix when appropriate. + +Please allow reasonable time for investigation and remediation before publicly disclosing the vulnerability. + +## Responsible Disclosure + +We appreciate responsible security research and coordinated disclosure. + +Security researchers are encouraged to avoid accessing, modifying, or deleting data belonging to others and to avoid actions that could disrupt services or users. + +Thank you for helping improve the security of this project. From bca0622dac33e424baa85990c0d325da107252f7 Mon Sep 17 00:00:00 2001 From: Cathryn Lavery Date: Tue, 11 Aug 2026 13:50:03 -0700 Subject: [PATCH 2/2] docs: make security reporting operational --- SECURITY.MD | 51 --------------------------------------------------- SECURITY.md | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 51 deletions(-) delete mode 100644 SECURITY.MD create mode 100644 SECURITY.md diff --git a/SECURITY.MD b/SECURITY.MD deleted file mode 100644 index d04547e..0000000 --- a/SECURITY.MD +++ /dev/null @@ -1,51 +0,0 @@ -# Security Policy - -## Supported Versions - -Security updates are provided for actively maintained versions of this project. - -| Version | Supported | -| ------- | --------- | -| Latest release | :white_check_mark: | -| Older releases | :x: | - -## Reporting a Vulnerability - -If you discover a security vulnerability in this project, please report it responsibly. - -Please do not disclose security vulnerabilities publicly through GitHub Issues, Pull Requests, or other public channels before the maintainers have had an opportunity to investigate. - -### How to Report - -Please use GitHub's private vulnerability reporting feature for this repository if it is available. - -If private vulnerability reporting is not available, contact the project maintainers through the repository's official GitHub channels and clearly identify the report as a security vulnerability. - -Please include: - -- A clear description of the vulnerability -- The affected component, file, or feature -- Steps to reproduce the issue -- The potential security impact -- Any proof-of-concept or relevant logs, if available -- A suggested mitigation or fix, if you have one - -### What to Expect - -After receiving a vulnerability report, maintainers should: - -1. Acknowledge receipt of the report. -2. Investigate and validate the reported issue. -3. Determine the severity and affected versions. -4. Develop and test an appropriate fix. -5. Release or communicate the fix when appropriate. - -Please allow reasonable time for investigation and remediation before publicly disclosing the vulnerability. - -## Responsible Disclosure - -We appreciate responsible security research and coordinated disclosure. - -Security researchers are encouraged to avoid accessing, modifying, or deleting data belonging to others and to avoid actions that could disrupt services or users. - -Thank you for helping improve the security of this project. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..ed7af32 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,38 @@ +# Security Policy + +## Supported versions + +Security fixes are applied to the latest commit on the `main` branch. This +repository does not currently publish versioned releases, so older commits and +forks are not maintained as separate security-support channels. + +## Report a vulnerability privately + +Please use [GitHub private vulnerability reporting](https://github.com/cathrynlavery/diagram-design/security/advisories/new). +Do not disclose a suspected vulnerability in a public issue, pull request, +discussion, or social-media post before we have coordinated disclosure. + +Include as much of the following as you can: + +- the affected file, script, or workflow; +- a description of the impact and who could be affected; +- clear reproduction steps or a minimal proof of concept; +- any conditions required to exploit the issue; +- a suggested mitigation, if you have one. + +Avoid including secrets, credentials, or personal data in the report. + +## What to expect + +We will acknowledge the report as soon as practical, validate the finding, +determine its scope, and coordinate remediation and disclosure with the +reporter. Please allow time for a fix to be developed and tested before public +disclosure. + +## Good-faith research + +Please avoid accessing, modifying, or deleting data that does not belong to +you, disrupting services, or degrading other users' experience. If testing +could affect other people or systems, stop and submit a private report first. + +Thank you for helping keep Diagram Design and its users safe.