Conversation
github-actions
bot
added
the
type: chore
There was a problem hiding this comment.
Pull request overview
Adds a SECURITY.md file to document Decap CMS’s security policy, including supported versions and a vulnerability reporting process.
Changes:
- Introduces a Security Policy document (
SECURITY.md) - Documents supported versions and lifecycle status
- Describes the coordinated disclosure process and reporting instructions
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
yanthomasdev
left a comment
yanthomasdev
left a comment
There was a problem hiding this comment.
Thanks @martinjagodic, I have a few suggestions and comments here.
SECURITY.md
Outdated
|
|
||
| If you discover a security vulnerability in Decap CMS, please report it **confidentially** through our dedicated reporting process. | ||
|
|
||
| **Submit your report at:** https://decapcms.org/report-vulnerability |
There was a problem hiding this comment.
This link doesn't work for me. nevermind, just saw it is open in a decap-website PR
I think we should allow multiple reporting sources, the form will not always be available, and we want to make it as convenient as possible so that the more security issues are reported. For example, I think we can enable GitHub's security advisory and add an security email like security@decapcms.org.
There was a problem hiding this comment.
Let's go with GitHub Security Advisories only for now. I updated the document.
Co-authored-by: Yan <61414485+yanthomasdev@users.noreply.github.com>
2 participants
Adds a document outlining the security policy for the Decap CMS project