From 49f78bb1b95679d126f3274404719fb053e33a9d Mon Sep 17 00:00:00 2001 From: kkdev92 Date: Thu, 13 Aug 2026 01:37:11 +0900 Subject: [PATCH] docs: link the vulnerability report form instead of describing it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Scorecard scores SecurityPolicy 4 of 10 with `Warn: no linked content found`, and the correlation across the four repositories here is exact: the two with no links in SECURITY.md are flagged, the two with one are not. The link is worth more than the score. The policy said "use the Report a vulnerability button in the Security tab", which describes where a feature lives rather than taking someone there — and private reporting was only enabled today, so `…/security/advisories/new` is now a real door. Someone holding a vulnerability should not have to go looking for it. It also now says that reporting is private, which is the reason not to open an issue and was left implicit before. Co-Authored-By: Claude Opus 5 --- SECURITY.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 5067253..e6df7ec 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,12 @@ Fixes ship in a new release rather than as patches to earlier versions. ## Reporting a Vulnerability 1. **Do NOT** create a public GitHub issue. -2. Use GitHub's **"Report a vulnerability"** feature in the Security tab of this repository. +2. Open a private report: + + + That is the **"Report a vulnerability"** button in this repository's Security + tab; the link goes straight to it. Private reporting is enabled, so the + advisory stays between us until there is a fix to describe. Reports are looked at on a best-effort basis; please allow a reasonable disclosure window.