What the developer wrote
Authored by Roman Zeyde
Add SECURITY.md
What changed, and why it matters
This commit only adds a SECURITY.md file to the project. It is a documentation-only change that explains the project's security policy and how to report vulnerabilities. No code was changed, and no security vulnerability was fixed or introduced.
No action required. This is a policy documentation addition. Review the SECURITY.md content for clarity if desired.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit adds a SECURITY.md file with 14 lines. It states the maintainer recommends self-hosting, excludes denial-of-service attacks from the threat model, and provides contact information for vulnerability reports. There are no code modifications, dependency changes, or configuration changes.
Changed components
Inspect captured patch +14 / −0
### SECURITY.md
@@ -0,0 +1,14 @@
+# Security Policy
+
+I highly recommend self-hosting electrs.
+
+Denial-of-Service attacks are excluded from the threat model - DO NOT share your electrs instance with untrusted users!
+
+## Reporting a Vulnerability
+
+Contact me at dev@romanzey.de and include the following:
+
+ Code – A proof of concept demonstrating the issue.
+ Description – A thorough explanation of the bug and its potential impact.
+
+In case you consider this a sensitive matter, I will provide instructions on how to set up a Signal encrypted channel.Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.