From d991188c195dec6e29d3e3dc76c74ce6eb79acd7 Mon Sep 17 00:00:00 2001 From: Andreas Nedbal Date: Mon, 30 Jan 2023 22:07:36 +0100 Subject: [PATCH] Add security policy --- SECURITY.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..0bef6de2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,13 @@ +# Security Policy + +If you believe you've found a security vulnerability in Retrospring (a bug that allows something to happen that shouldn't be possible), you can reach us at . + +You should *not* report such issues on GitHub or in other public spaces to give us time to publish a fix for the issue without exposing Retrospring's users to increased risk. + +## Scope + +A "vulnerability in Retrospring" is a vulnerability in the code distributed through our main source code repository on GitHub. Vulnerabilities that are specific to a given installation (e.g. misconfiguration) should be reported to the owner of that installation and not us. + +## Supported Versions + +As long as Retrospring is in rapid development pace the currently supported version for security issues is always the [latest tagged release](https://github.com/Retrospring/retrospring/releases/latest).