From 8627b06da39b54d6d41fbd84b94c7e64592d93bf Mon Sep 17 00:00:00 2001 From: Yachika Sharma Date: Mon, 29 Jun 2026 16:35:08 +0530 Subject: [PATCH 1/3] docs: add SECURITY.md with vulnerability disclosure policy --- SECURITY.md | 50 ++++++++++++++++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 20 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 40ae32ea..1fad69e6 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,20 +2,16 @@ ## Supported Versions -The following versions of **DevCard** are currently supported with security updates: - -| Version | Supported | -| ------- | ------------------ | -| main | ✅ Yes | +| Version | Supported | +|---------|-----------| +| main | ✅ Yes | ## Reporting a Vulnerability -If you discover a security vulnerability in **DevCard**, please **do not open a public issue**. - -Instead, report it responsibly by: +Please report via **GitHub Private Security Advisory**: +[Report here](https://github.com/Dev-Card/DevCard/security/advisories/new) -- 📧 Reaching out to the maintainer directly via their [GitHub profile](https://github.com/Dev-Card) -- 💬 Sending a private message through GitHub's messaging or social links listed in the profile +**Do NOT open a public issue for security vulnerabilities.** ### What to include in your report: - A clear description of the vulnerability @@ -25,18 +21,32 @@ Instead, report it responsibly by: ## Response Timeline -| Action | Timeframe | -| ----------------------------- | ----------------- | -| Acknowledgement of report | Within 48 hours | -| Status update | Within 7 days | -| Patch / fix release | Within 30 days | +| Action | Timeframe | +|---------------------------|-----------------| +| Acknowledgement of report | Within 48 hours | +| Status update | Within 7 days | +| Patch / fix release | Within 30 days | + +## In Scope +- Authentication bypass +- Sensitive data exposure via API endpoints +- XSS in profile/card rendering +- Unauthorized access to user contact data + +## Out of Scope +- Rate limiting / brute force without impact +- Spam or social engineering +- Issues in third-party dependencies (report upstream) ## Responsible Disclosure -We follow a **responsible disclosure** policy. Please give us adequate time to patch the issue before any public disclosure. We deeply appreciate security researchers who help keep **DevCard** safe. 🙏 +Please give us adequate time to patch the issue before any public disclosure. +We deeply appreciate security researchers who help keep **DevCard** safe. 🙏 -## References +## Acknowledgements + +Responsible reporters will be credited in release notes (with permission). -- [DevCard Repository](https://github.com/Dev-Card/DevCard) -- [GitHub Security Advisories](https://docs.github.com/en/code-security/security-advisories) -- [Adding a Security Policy to your repo](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository) +## References +- [GitHub Security Advisories Docs](https://docs.github.com/en/code-security/security-advisories) +- [Adding a Security Policy](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository) \ No newline at end of file From f193daa25df4dacb54ca24c5498a03d28db4c101 Mon Sep 17 00:00:00 2001 From: Yachika Sharma Date: Wed, 1 Jul 2026 14:18:44 +0530 Subject: [PATCH 2/3] docs: revert table formatting as per review --- SECURITY.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 1fad69e6..7c82440e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,7 @@ | Version | Supported | |---------|-----------| -| main | ✅ Yes | +| latest | ✅ | ## Reporting a Vulnerability @@ -21,11 +21,9 @@ Please report via **GitHub Private Security Advisory**: ## Response Timeline -| Action | Timeframe | -|---------------------------|-----------------| -| Acknowledgement of report | Within 48 hours | -| Status update | Within 7 days | -| Patch / fix release | Within 30 days | +- Acknowledgement: within 48–72 hours +- Status update: within 7 days +- Patch / fix release: within 30 days ## In Scope - Authentication bypass From 8a66487df80b1a23c66cc43321c2e2800a064c64 Mon Sep 17 00:00:00 2001 From: Yachika Sharma Date: Thu, 2 Jul 2026 13:24:46 +0530 Subject: [PATCH 3/3] docs: revert supported versions table to original format --- SECURITY.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 7c82440e..704557c9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,9 +2,11 @@ ## Supported Versions -| Version | Supported | -|---------|-----------| -| latest | ✅ | +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| main | ✅ Yes | ## Reporting a Vulnerability