GitHub recommends that projects have a Security Policy (SECURITY.md). This is a simple document that explains how the project wishes to receive and handle responsible disclosure of potential vulnerabilities.
There are a few ways to receive such disclosures:
have an email or website available to receive such reports; and/or
GitHub recommends that projects have a Security Policy (SECURITY.md). This is a simple document that explains how the project wishes to receive and handle responsible disclosure of potential vulnerabilities.
There are a few ways to receive such disclosures:
If you're interested in GitHub's feature, it must be activated for the repository:
I'll send a PR with a draft policy along with this issue.