From 612c66c73ca6f283fb77782d9e7ca69a327eefac Mon Sep 17 00:00:00 2001 From: Julian Sommer <115516918+juliansommer@users.noreply.github.com> Date: Mon, 7 Sep 2026 15:17:13 +1000 Subject: [PATCH] fix: add SECURITY.md --- SECURITY.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..dcedf6b45 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,24 @@ +# Security Policy + +## Reporting a Vulnerability + +Please do not open a public issue for a security vulnerability. + +Report it privately, either way works: + +- [Open a private security advisory](https://github.com/mulgadc/spinifex/security/advisories/new) on this repository. +- Email . + +Please include enough for us to reproduce it: the version or commit, the configuration involved, and the steps that trigger it. If you have a proof of concept, include that too. + +## What Happens Next + +We aim to acknowledge a report within three business days. We will confirm whether we can reproduce it, agree a fix and a disclosure timeline with you, and credit you in the advisory unless you would rather we did not. + +## Scope + +Spinifex is one part of the [Mulga](https://mulgadc.com) stack. If a vulnerability spans more than one component, report it once against whichever repository you found it in and we will handle the rest. + +## Supported Versions + +Fixes land on the latest release and on `main`. Older releases are not patched.