From 473a8587bdede1c639cb632869e9b93456c46ac1 Mon Sep 17 00:00:00 2001 From: DevClinic Date: Tue, 11 Aug 2026 01:46:24 +0100 Subject: [PATCH] Update private vulnerability reporting guidance --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index d061e4a..5e8c077 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,7 +8,7 @@ Only the latest tagged beta is supported for security fixes. Please do **not** open a public issue for a suspected vulnerability involving HID access, installer/update behaviour, local data, or a protocol write path. -After publishing this repository, use GitHub’s **Security → Report a vulnerability** private reporting flow. The repository owner must enable private vulnerability reporting in the GitHub repository settings before the first public release. If that setting is not yet enabled, contact the repository owner privately rather than posting technical exploit details publicly. +Use GitHub's **Security > Report a vulnerability** private reporting flow for this repository. This sends the report privately to the maintainers so details can be assessed and addressed before public disclosure. Useful reports include a minimal reproduction, affected version, expected and observed behaviour, and only the smallest redacted diagnostic excerpt needed to understand the issue.