Hey, it's Pedro and I'm back (see #563) with another security suggestion!
A security policy (SECURITY.md) explains how the project wishes to receive and handle responsible disclosure of potential vulnerabilities. GitHub recommends that projects have one.
The security policy can be found by users who enter the project's "Security" panel. They'll also see references to it in the "New issue" page.
There are two main ways to receive disclosures:
register an email or website available to receive such reports; and/or
Hey, it's Pedro and I'm back (see #563) with another security suggestion!
A security policy (SECURITY.md) explains how the project wishes to receive and handle responsible disclosure of potential vulnerabilities. GitHub recommends that projects have one.
The security policy can be found by users who enter the project's "Security" panel. They'll also see references to it in the "New issue" page.
There are two main ways to receive disclosures:
If you want to use GitHub's reporting system, it must be activated for the repository:
I'll send a PR with a draft policy along with this issue.