e8064a6932* Add `SECURITY.md` file The other day, Rodrigo and me noticed that WPCS does not have a published security policy (via a `SECURITY.md` file). This commit intends to add such a file, which should help inform security researchers how to disclose any findings they may have. The file is placed in the `.github` directory. This will allow for it to be recognized correctly by GitHub, while not cluttering up the project root directory. Ref: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy --------- Co-authored-by: jrfnl <jrfnl@users.noreply.github.com> Co-authored-by: Denis Žoljom <dingo-d@users.noreply.github.com>
1.3 KiB
Security Policy
Supported Versions
The latest minor version of the 3.x release series is supported for security updates.
Reporting a Vulnerability
The WordPressCS team takes security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
Please do not report or discuss security vulnerabilities through public GitHub issues, discussions, or pull requests.
Issues can be reported privately to the maintainers by opening a Security vulnerability report.
Caution
Please take note that while the WordPress organisation has a HackerOne program, the WordPress Coding Standards software is not covered by this program. Full details of the WordPress Security Policy and the list of covered projects and infrastructure can be found on HackerOne.
Preferences
- Please provide detailed reports with reproducible steps and a clearly defined impact.
- Include the version number of the vulnerable package in your report.
- Fixes are most welcome.
A private PR can be created from the security report to work on and discuss the patch.
