From 4ebea5100dd5fbe1d5ec2fab461548a54ebb5ab0 Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Thu, 27 Aug 2026 02:17:07 +0200 Subject: [PATCH] chore: add the org SECURITY.md --- SECURITY.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..30899c5 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,35 @@ +# Security Policy + +## Reporting A Vulnerability + +Do not report vulnerabilities in public issues, pull requests, discussions, or +commit comments. + +Report suspected vulnerabilities privately to: + +- `security@jorisjonkers.dev` + +Include: + +- affected repository and commit, tag, or version +- concise impact description +- reproduction steps or proof of concept +- relevant logs with secrets and private data removed + +## Handling + +Security reports are reviewed privately. Public disclosure, issue creation, and +fix details are coordinated by Joris Jonkers after the risk is understood and a +remediation path exists. + +## Supported Code + +Only the current default branch and actively released packages or images are in +scope. Archived repositories, old branches, and historical tags are not +supported unless Joris Jonkers explicitly says otherwise. + +## Source Availability + +Public visibility does not grant permission to use, copy, modify, deploy, +redistribute, or derive from this code. Repository licensing is governed by the +root `LICENSE` file.