mirror of
https://github.com/WordPress/WordPress-Coding-Standards.git
synced 2026-08-03 14:30:43 +08:00
e8064a6932* Add `SECURITY.md` file The other day, Rodrigo and me noticed that WPCS does not have a published security policy (via a `SECURITY.md` file). This commit intends to add such a file, which should help inform security researchers how to disclose any findings they may have. The file is placed in the `.github` directory. This will allow for it to be recognized correctly by GitHub, while not cluttering up the project root directory. Ref: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy --------- Co-authored-by: jrfnl <jrfnl@users.noreply.github.com> Co-authored-by: Denis Žoljom <dingo-d@users.noreply.github.com>
28 lines
1.3 KiB
Markdown
28 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
The latest minor version of the `3.x` release series is supported for security updates.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
The WordPressCS team takes security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
|
|
|
|
**Please do not report or discuss security vulnerabilities through public GitHub issues, discussions, or pull requests.**
|
|
|
|
Issues can be reported privately to the maintainers by opening a [Security vulnerability report].
|
|
|
|
> [!CAUTION]
|
|
> Please take note that while the WordPress organisation has a HackerOne program, the WordPress Coding Standards software is not covered by this program.
|
|
> Full details of the WordPress Security Policy and the list of covered projects and infrastructure can be found on [HackerOne][WordPress HackerOne].
|
|
|
|
### Preferences
|
|
|
|
* Please provide detailed reports with reproducible steps and a clearly defined impact.
|
|
* Include the version number of the vulnerable package in your report.
|
|
* Fixes are most welcome.
|
|
|
|
A private PR can be created from the security report to work on and discuss the patch.
|
|
|
|
[Security vulnerability report]: https://github.com/WordPress/WordPress-Coding-Standards/security/advisories/new
|
|
[WordPress HackerOne]: https://hackerone.com/wordpress
|
