Document security vulnerability reporting procedure in SECURITY.md

ustaxcourt / ef-cms

An Electronic Filing / Case Management System.

https://dawson.ustaxcourt.gov/

Other

85 stars 46 forks source link

Document security vulnerability reporting procedure in SECURITY.md #421

Open adunkman opened 3 years ago

adunkman commented 3 years ago

SECURITY.md is the standard location for security policies.

We should document how we would like to receive security vulnerabilities from anyone — employees, contractors, and the public — who discover security vulnerabilities. If we do not, vulnerabilities are more likely to be published publicly by filing public GitHub issues, which reduces our timeline to address them.

adunkman commented 3 years ago

Now that we have github issue templates, GitHub is directly picking up docs/security.md as our security policy: