Skip to content

Commit ad8d345

Browse files
authored
Update security policy to modern standards (#514)
1 parent 051b205 commit ad8d345

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

SECURITY.md

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,23 @@
33

44
## Supported Versions
55

6+
We normally support only the most recently released version with bug fixes, security updates and compatibility improvements.
7+
68
The following summarizes the support status of recent QtPy versions.
79

810
| Version | Supported |
911
| -------- | ------------------ |
1012
| 2.0.x | :heavy_check_mark: |
11-
| 1.11.x | :heavy_check_mark: |
12-
| <=1.10.x | :x: |
13+
| <2 | :x: |
1314

1415

1516

1617
## Reporting a Vulnerability
1718

18-
If you believe you've discovered a security vulnerability in Sub Manager, please contact the project maintainers, the Spyder development team, at spyder.python@gmail.com .
19+
If you believe you've discovered a security vulnerability in QtPy, please use open a new security advisory with [our GitHub repo's private vulnerability reporting](https://github.com/spyder-ide/qtpy/security/advisories/new).
1920
Please be sure to carefully document the vulnerability, including a summary, describing the impacts, identifying the line(s) of code affected, stating the conditions under which it is exploitable and including a minimal reproducible test case.
2021
Further information and advice or patches on how to mitigate it is always welcome.
2122
You can usually expect to hear back within 1 week, at which point we'll inform you of our evaluation of the vulnerability and what steps we plan to take, and will reach out if we need further clarification from you.
22-
Once its patched, we'll send a followup email letting you know, and are happy to update you on its status should you further inquire.
23-
While this is a volunteer project and we don't have financial compensation to offer, we can certainly publicly thank you for your help if you would like.
23+
We'll discuss and update the advisory thread, and are happy to update you on its status should you further inquire.
24+
While this is a volunteer project and we don't have financial compensation to offer, we can certainly publicly thank and credit you for your help if you would like.
2425
Thanks!

0 commit comments

Comments
 (0)