Skip to content

docs: add SECURITY.md with security policy #298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anjali1521 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: add SECURITY.md with security policy #298

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
# Security Policy

## Supported Versions

The following table lists which versions of this project are currently supported with security updates:

| Version | Supported |
| ------- | ------------------ |
| 5.1.x | ✅ |
| 5.0.x | ❌ |
| 4.0.x | ✅ |
| < 4.0 | ❌ |

## Reporting a Vulnerability

We take security issues seriously and appreciate your efforts to responsibly disclose any vulnerabilities.

- **How to report:** Please use the [GitHub Security Advisories](https://docs.github.com/en/code-security/security-advisories) feature to report vulnerabilities directly in this repository.
- **What to include:**
- A clear description of the vulnerability
- Steps to reproduce the issue
- Any potential impact or affected versions
- **Response timeline:**
- You will receive an acknowledgment within **48 hours**.
- Updates will be provided at least every **7 days** until resolution.
- **Resolution process:**
- If accepted, we will prioritize a fix and release a patched version promptly.
- If declined, we will explain why the issue is not considered a vulnerability.
- **Confidentiality:** Please do not disclose the vulnerability publicly until we have released a fix and confirmed resolution with you.
Comment on lines +23 to +29

@coderabbitai coderabbitai Bot Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Bound the fix and disclosure timelines.

“Release a patched version promptly” is not measurable, and confidentiality remains open-ended if confirmation is delayed. Define a target remediation/disclosure window and an explicit coordinated-disclosure fallback.

As per path instructions, this Markdown policy should provide clear and concise security-process explanations.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@SECURITY.md` around lines 23 - 29, Update the SECURITY.md “Resolution
process” and “Confidentiality” policy text to replace “promptly” and open-ended
confidentiality with a specific target remediation/disclosure window, plus an
explicit coordinated-disclosure fallback if confirmation is delayed. Keep the
existing acknowledgment and update commitments unchanged, and make the policy
concise and clear.

Source: Path instructions


---

Thank you for helping us keep this project secure!