From 3004aa7f53010adcc25eb8f4f6803b4222b776fc Mon Sep 17 00:00:00 2001 From: SMNET Studio Date: Thu, 13 Aug 2026 16:19:09 +0800 Subject: [PATCH] docs: add security policy --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..db8af99 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,21 @@ +# Security Policy + +## Supported Versions + +The following versions of the project are currently being supported with security updates: + +| Version | Supported | +| ------- | ------------------ | +| 0.12.x | :white_check_mark: | +| 0.11.x | :x: | +| 0.10.x | :white_check_mark: | +| < 0.10 | :x: | + +## Reporting a Vulnerability + +Please report security vulnerabilities by opening a private issue or contacting the maintainers directly. + +- **Where to report:** Open an issue on the repository or email the maintainers directly. Do not disclose vulnerabilities publicly before they have been addressed. +- **Response time:** You can expect an acknowledgement of your report within **48 hours**, and a status update on the reported vulnerability at least once per week. +- **What to expect if accepted:** The vulnerability will be assigned a severity level, tracked privately, and a fix will be prioritized based on severity. A security advisory and patch release will be published once the fix is ready. +- **What to expect if declined:** If the report is determined not to be a vulnerability, you will receive a detailed explanation of why it was declined.