From 6978a689cf78f0fa9923e788168139bf34c80ec8 Mon Sep 17 00:00:00 2001
From: redonkulus <seth@bertalotto.net>
Date: Fri, 23 Oct 2026 07:01:04 -0700
Subject: [PATCH] docs: add SECURITY.md pointing to private vulnerability
 reporting

Researchers had no documented channel for reporting vulnerabilities, so
reports arrived by personal email. Point them to GitHub's private
vulnerability reporting (now enabled), list supported versions, and
spell out the function-source threat model.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 SECURITY.md | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..ed93762
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,31 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are released for the latest major version only.
+
+| Version | Supported |
+| ------- | --------- |
+| 7.x     | Yes       |
+| < 7.0   | No        |
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues, pull requests, or discussions.
+
+Instead, report them privately through GitHub's [private vulnerability reporting](https://github.com/yahoo/serialize-javascript/security/advisories/new). This opens a draft security advisory that only the maintainers can see, where we can discuss the issue with you, develop a fix, and coordinate disclosure.
+
+Please include:
+
+- The affected version(s)
+- A minimal reproduction (input, options, and the resulting output)
+- The context the output is used in (e.g. embedded in an HTML `<script>` element)
+- The impact you believe it has
+
+We will acknowledge your report as soon as we can, keep you updated on progress, and credit you in the published advisory unless you prefer otherwise.
+
+## Scope
+
+`serialize-javascript` escapes its output so it can be safely embedded in an HTML `<script>` element (unless `options.unsafe` is set). Reports that untrusted **data** (strings, object keys, regexps, dates, etc.) can break out of that context are in scope.
+
+Serializing a **function** emits its source text as code. If an attacker can control the source text of a function you serialize, they can already run code in your page, so that is not a vulnerability by itself. We still treat a function body that escapes the `<script>` element (for example, injecting HTML markup) as a defect and fix it, but it is considered low severity.