From ea5cb5217d5ad75e87deef04a67cf79c093edded Mon Sep 17 00:00:00 2001 From: Asmir Mustafic Date: Sat, 24 Oct 2026 07:38:26 +0200 Subject: [PATCH] Add security policy Document how to privately report vulnerabilities (refs #283). Co-Authored-By: Claude Sonnet 5.5 --- SECURITY.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..a6984dd --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,29 @@ +# Security Policy + +## Supported Versions + +Security fixes are provided for the latest release of the 2.x series. + +| Version | Supported | +| ------- | --------- | +| 2.x | Yes | +| < 2.0 | No | + +## Reporting a Vulnerability + +Please do **not** report security vulnerabilities through public GitHub issues, +discussions or pull requests. + +Report them privately using GitHub's +[private vulnerability reporting](https://github.com/Masterminds/html5-php/security/advisories/new) +("Security" tab → "Report a vulnerability"). + +Please include as much of the following as you can: + +- the affected version(s) and PHP version, +- a description of the issue and its impact, +- a minimal HTML input or code sample that reproduces it. + +We will acknowledge your report, keep you informed while we investigate, and +coordinate a fix and disclosure with you. Once a fix is released, the +vulnerability will be published as a GitHub security advisory.