Skip to content

docs: add SECURITY.md with vulnerability disclosure policy #651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ShantKhatri merged 3 commits into from
Jul 2, 2026
Merged

docs: add SECURITY.md with vulnerability disclosure policy #651

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8627b06
docs: add SECURITY.md with vulnerability disclosure policy
yachikadev Jun 29, 2026
f193daa
docs: revert table formatting as per review
yachikadev Jul 1, 2026
8a66487
docs: revert supported versions table to original format
yachikadev Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 26 additions & 16 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,20 +2,18 @@

## Supported Versions

The following versions of **DevCard** are currently supported with security updates:
## Supported Versions

| Version | Supported |
| ------- | ------------------ |
| main | ✅ Yes |

## Reporting a Vulnerability

If you discover a security vulnerability in **DevCard**, please **do not open a public issue**.

Instead, report it responsibly by:
Please report via **GitHub Private Security Advisory**:
[Report here](https://github.com/Dev-Card/DevCard/security/advisories/new)

- 📧 Reaching out to the maintainer directly via their [GitHub profile](https://github.com/Dev-Card)
- 💬 Sending a private message through GitHub's messaging or social links listed in the profile
**Do NOT open a public issue for security vulnerabilities.**

### What to include in your report:
- A clear description of the vulnerability
Expand All @@ -25,18 +23,30 @@ Instead, report it responsibly by:

## Response Timeline

| Action | Timeframe |
| ----------------------------- | ----------------- |
| Acknowledgement of report | Within 48 hours |
| Status update | Within 7 days |
| Patch / fix release | Within 30 days |
- Acknowledgement: within 48–72 hours
- Status update: within 7 days
- Patch / fix release: within 30 days

## In Scope
- Authentication bypass
- Sensitive data exposure via API endpoints
- XSS in profile/card rendering
- Unauthorized access to user contact data

## Out of Scope
- Rate limiting / brute force without impact
- Spam or social engineering
- Issues in third-party dependencies (report upstream)

## Responsible Disclosure

We follow a **responsible disclosure** policy. Please give us adequate time to patch the issue before any public disclosure. We deeply appreciate security researchers who help keep **DevCard** safe. 🙏
Please give us adequate time to patch the issue before any public disclosure.
We deeply appreciate security researchers who help keep **DevCard** safe. 🙏

## References
## Acknowledgements

Responsible reporters will be credited in release notes (with permission).

- [DevCard Repository](https://github.com/Dev-Card/DevCard)
- [GitHub Security Advisories](https://docs.github.com/en/code-security/security-advisories)
- [Adding a Security Policy to your repo](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository)
## References
- [GitHub Security Advisories Docs](https://docs.github.com/en/code-security/security-advisories)
- [Adding a Security Policy](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository)