From 47752273584797305f3750f04e9c3651cdf8bbe9 Mon Sep 17 00:00:00 2001 From: Yang Jun Date: Sat, 20 Jun 2026 00:00:05 +0800 Subject: [PATCH] docs(security): route vulnerability reports to GitHub Advisories (#913) Replace the private email contact with GitHub Security Advisories and set the common-case fix expectation to within a month. Co-authored-by: Cursor --- SECURITY.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index c3fcbdd97..985970f68 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,10 @@ Only the latest major version is supported with security updates. It can be chan ## Reporting a Vulnerability -Please contact harttleharttle@gmail.com to report a vulnerability or change request. +**Please do not report security vulnerabilities through public GitHub issues.** -- If the vulnerability in question affects common use cases, it will be treated as a bug and fixed very soon (typically within 1 week). +Report them via [GitHub Security Advisories — Report a vulnerability](https://github.com/harttle/liquidjs/security/advisories/new). + +- If the vulnerability in question affects common use cases, it will be treated as a bug and fixed very soon (typically within a month). - Otherwise, it'll be scheduled in the same priority of feature request (which is lower than bugs). -- If the request is declined, you'll receive a reply email anyway (most likely there will be a discussion). +- If the request is declined, you'll receive a reply anyway (most likely there will be a discussion).