From 74d05333bbdd99baa4ccbdf18eb3a5bc57691d59 Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Fri, 9 Oct 2026 16:09:08 -0700 Subject: [PATCH] docs: report vulnerabilities privately Vulnerabilities go through GitHub's private reporting instead of public issues, using quickstart-openshift's wording. Refs #597 --- SECURITY.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f487e04..ffe0d5e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,9 +2,15 @@ ## Supported Versions -This product currently has no support and is experimental. That could change in future. - +This product currently has no support and is experimental. That could change in the future. ## Reporting a Vulnerability -Please report any issues or vulerabilities with an [issue](https://github.com/bcgov/pubcode/issues). +**DO NOT open public GitHub issues for security vulnerabilities.** + +If you believe you have found a security vulnerability in this project, please report it privately: + +1. Navigate to the main page of this repository on GitHub. +2. Click the **"Security"** tab at the top of the repository (next to "Insights"). +3. In the left sidebar under "Reporting", click **"Advisories"**. +4. Click the **"Report a vulnerability"** button to privately submit a report to the repository maintainers.