From f293959b4905084619eb6ccd1bd35302e87d666e Mon Sep 17 00:00:00 2001
From: OrangeJerry <62132919+OrangeJerry@users.noreply.github.com>
Date: Tue, 27 May 2025 21:53:10 +0800
Subject: [PATCH 1/5] Create SECURITY.md

---
 SECURITY.md | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..085fdca02b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,41 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+### Types of Security Issues
+We actively monitor:  
+- Code vulnerabilities (RCE, XSS, authentication bypass)  
+- Dependency risks (critical CVEs in `requirements.txt`)  
+- Configuration flaws (insecure defaults in deployment scripts)  
+
+### Disclosure Channels (Choose one):
+
+1. **Encrypted Email**  
+   Contact: `wangfeng19950315@163.com`  
+   *Subject format: `[SECURITY] ModuleName - Brief Description`*
+
+2. **GitHub Private Report**  
+   Use GitHub's ["Report a vulnerability"](https://github.com/Megvii-BaseDetection/YOLOX/security/advisories) feature  
+
+3. **Reporting Security Issues**  
+   Please report security issues using Create new issue: https://github.com/Megvii-BaseDetection/YOLOX/issues/new
+
+
+## Response Process  
+1. **Acknowledgement**  
+   - Initial response within **48 business hours**  
+2. **Assessment**  
+   - Triage using CVSS v3.1 scoring  
+3. **Remediation**  
+   - Critical (CVSS ≥9.0): Patch within **7 days**  
+   - High (CVSS 7-8.9): Patch within **30 days**  
+4. **Public Disclosure**  
+   - Published via [GitHub Advisories](https://github.com/Megvii-BaseDetection/YOLOX/security/advisories)  
+   - CVE assignment coordinated with [MITRE](https://cveform.mitre.org)
+  
+   - https://github.com/ossf/scorecard/blob/1e72b3ac6e297e29c63156145f945a464f087675/docs/checks.md#signed-releases
+
+## Secure Development Practices  
+- Always verify hashes when downloading dependencies:  
+  ```bash
+  sha256sum -c requirements.sha256

From f60bc770413d0ec4a97bf18b5277d652cc313146 Mon Sep 17 00:00:00 2001
From: OrangeJerry <62132919+OrangeJerry@users.noreply.github.com>
Date: Tue, 27 May 2025 22:06:11 +0800
Subject: [PATCH 2/5] Update SECURITY.md

---
 SECURITY.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 085fdca02b..f591290df1 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -33,8 +33,6 @@ We actively monitor:
    - Published via [GitHub Advisories](https://github.com/Megvii-BaseDetection/YOLOX/security/advisories)  
    - CVE assignment coordinated with [MITRE](https://cveform.mitre.org)
   
-   - https://github.com/ossf/scorecard/blob/1e72b3ac6e297e29c63156145f945a464f087675/docs/checks.md#signed-releases
-
 ## Secure Development Practices  
 - Always verify hashes when downloading dependencies:  
   ```bash

From 8939e85109086d3ba6ae97dfb382487c19064deb Mon Sep 17 00:00:00 2001
From: OrangeJerry <62132919+OrangeJerry@users.noreply.github.com>
Date: Wed, 4 Jun 2025 21:38:12 +0800
Subject: [PATCH 3/5] Update SECURITY.md

The "Dependency risks" section to avoid hardcoding requirements.txt.

The "Secure Development Practices" section to generalize the hash verification instructions.
---
 SECURITY.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index f591290df1..3421365cc2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -5,7 +5,7 @@
 ### Types of Security Issues
 We actively monitor:  
 - Code vulnerabilities (RCE, XSS, authentication bypass)  
-- Dependency risks (critical CVEs in `requirements.txt`)  
+- Dependency risks (critical vulnerabilities in project dependencies, such as requirements.txt, pyproject.toml, or equivalent files)  
 - Configuration flaws (insecure defaults in deployment scripts)  
 
 ### Disclosure Channels (Choose one):
@@ -36,4 +36,4 @@ We actively monitor:
 ## Secure Development Practices  
 - Always verify hashes when downloading dependencies:  
   ```bash
-  sha256sum -c requirements.sha256
+  sha256sum -c <your-dependency-hash-file>

From 4efc90565cf5e39cead42462c99f70d350c64268 Mon Sep 17 00:00:00 2001
From: OrangeJerry <62132919+OrangeJerry@users.noreply.github.com>
Date: Fri, 6 Jun 2025 12:12:31 +0800
Subject: [PATCH 4/5] Update SECURITY.md

fix:close bash quote
---
 SECURITY.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/SECURITY.md b/SECURITY.md
index 3421365cc2..5c2e02697e 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -37,3 +37,4 @@ We actively monitor:
 - Always verify hashes when downloading dependencies:  
   ```bash
   sha256sum -c <your-dependency-hash-file>
+  ```

From bd73a538804f71329d6f00cb200fd34f1a611d36 Mon Sep 17 00:00:00 2001
From: OrangeJerry <62132919+OrangeJerry@users.noreply.github.com>
Date: Fri, 6 Jun 2025 14:27:12 +0800
Subject: [PATCH 5/5] Update SECURITY.md