From 43f80263bac97c8c6d23a64da45892697be6f553 Mon Sep 17 00:00:00 2001 From: Vincenzo Palazzo Date: Wed, 12 Aug 2026 15:12:41 +0200 Subject: [PATCH] doc: mention GitHub private vulnerability reporting in SECURITY.md The security policy only listed the security@blockstream.com email as a reporting channel. Private vulnerability reporting is enabled on this repository, so advertise it as the preferred channel: it keeps reports private by default, lets reporters and maintainers collaborate on a fix in a single draft advisory, and streamlines CVE assignment and coordinated disclosure. The email address remains documented as an alternative. Changelog-None --- SECURITY.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 134b8e988015..f82719b65e07 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,10 +6,18 @@ We have a 3 month release cycle, and the last two versions are supported. ## Reporting a Vulnerability -To report security vulnerabilities, please send an email to: -- `security@blockstream.com` - -Note: This email address is exclusively for vulnerability reporting. +To report security vulnerabilities, you can either: + +- **Use GitHub private vulnerability reporting** (preferred): click + ["Report a vulnerability"](https://github.com/ElementsProject/lightning/security/advisories/new) + in the [Security](https://github.com/ElementsProject/lightning/security) tab. + This creates a private draft security advisory that is only visible to + you and the maintainers, and gives us a single place to discuss the + issue, collaborate on a fix, and coordinate disclosure (including + requesting a CVE). +- **Send an email** to `security@blockstream.com` (GPG key below). + +Note: The email address is exclusively for vulnerability reporting. For all other inquiries/communication, please refer to the [Reach Out to Us](https://github.com/ElementsProject/lightning?tab=readme-ov-file#reach-out-to-us) section in our README.