From 67b0f32456d0216e4c685a104c680fa5a5fd578f Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Wed, 11 Mar 2026 20:21:32 +0100 Subject: [PATCH] fix: update security policy with proper contact email and private reporting - Replace placeholder security@example.com with info@picpeak.app - Add GitHub Private Vulnerability Reporting links - Update supported versions table to 2.x.x Closes #223 --- .github/ISSUE_TEMPLATE/security_vulnerability.md | 2 +- SECURITY.md | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/security_vulnerability.md b/.github/ISSUE_TEMPLATE/security_vulnerability.md index 68464087..8ca805e6 100644 --- a/.github/ISSUE_TEMPLATE/security_vulnerability.md +++ b/.github/ISSUE_TEMPLATE/security_vulnerability.md @@ -9,7 +9,7 @@ assignees: '' ⚠️ **IMPORTANT: For serious security vulnerabilities, please DO NOT create a public issue.** -Instead, please email security@example.com with the details. +Instead, please use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new) or email **info@picpeak.app** with the details. For minor security improvements or questions, you can use this template: diff --git a/SECURITY.md b/SECURITY.md index e153e046..d663cb7f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,8 @@ We release patches for security vulnerabilities. Currently supported versions: | Version | Supported | | ------- | ------------------ | -| 1.x.x | :white_check_mark: | -| < 1.0 | :x: | +| 2.x.x | :white_check_mark: | +| < 2.0 | :x: | ## Reporting a Vulnerability @@ -15,9 +15,9 @@ We take the security of PicPeak seriously. If you have discovered a security vul ### 1. **Do NOT create a public GitHub issue** -### 2. Report the vulnerability by: -- Opening a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub -- Mark it clearly as "SECURITY" in the title +### 2. Report the vulnerability privately by: +- **Preferred:** Use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new) +- **Alternative:** Email us at **info@picpeak.app** with the details - Include: - Description of the vulnerability - Steps to reproduce @@ -82,7 +82,7 @@ We believe in responsible disclosure. Once a vulnerability is fixed: ## Contact -- Security issues: [Create a security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub +- Security issues: Email **info@picpeak.app** or use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new) - General support: [GitHub Issues](https://github.com/the-luap/picpeak/issues) Thank you for helping keep PicPeak and its users safe! \ No newline at end of file