Create SECURITY.md for security policy#256
Conversation
Add a security policy document outlining supported versions and vulnerability reporting.
There was a problem hiding this comment.
Pull request overview
Adds a SECURITY.md file intended to define the repository’s security policy (supported versions and how to report vulnerabilities).
Changes:
- Introduces
SECURITY.mdwith sections for supported versions and vulnerability reporting.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Use this section to tell people about which versions of your project are | ||
| currently being supported with security updates. |
There was a problem hiding this comment.
This section still contains the default GitHub template text rather than a project-specific supported-versions policy. Please replace the placeholder guidance with concrete support commitments (e.g., which Electron Forge major/minor lines receive security fixes and for how long).
| | 5.1.x | :white_check_mark: | | ||
| | 5.0.x | :x: | | ||
| | 4.0.x | :white_check_mark: | | ||
| | < 4.0 | :x: | | ||
|
|
There was a problem hiding this comment.
The supported versions table appears to be copied from the default template (e.g., 5.1.x / 4.0.x) and doesn’t match this repo’s documented Electron Forge versions (README references v7.x). Please update the version ranges to reflect the actual supported release lines for this project.
| | 5.1.x | :white_check_mark: | | |
| | 5.0.x | :x: | | |
| | 4.0.x | :white_check_mark: | | |
| | < 4.0 | :x: | | |
| | 7.x | :white_check_mark: | | |
| | < 7.0 | :x: | |
| Use this section to tell people how to report a vulnerability. | ||
|
|
||
| Tell them where to go, how often they can expect to get an update on a | ||
| reported vulnerability, what to expect if the vulnerability is accepted or | ||
| declined, etc. |
There was a problem hiding this comment.
This vulnerability reporting section is still placeholder text. Please specify an actual reporting channel (e.g., GitHub Security Advisories / private email), expected response timelines, and what reporters should include so reports can be triaged effectively.
Add a security policy document outlining supported versions and vulnerability reporting.