SECURITY.md: enable "private vuln reports" on GitHub
What the developer wrote
Authored by SomberNight
SECURITY.md: enable "private vuln reports" on GitHub
ref https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/privately-reporting-a-security-vulnerability
What changed, and why it matters
This commit only updates the project's SECURITY.md file to add a new preferred way for researchers to privately report security vulnerabilities through GitHub's built-in reporting feature. It does not change any application code, fix a bug, or address an active security issue. It is a documentation/process change only.
No action required; this is a policy/documentation update. Continue normal security monitoring.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies SECURITY.md to make GitHub’s ‘Report a vulnerability’ flow the preferred reporting channel, while retaining email reporting as an alternative. No source code, configuration, cryptography, or runtime behavior is changed. There is no patch of any vulnerability.
Changed components
Inspect captured patch +8 / −16
diff --git a/SECURITY.md b/SECURITY.md
index 4ef19f8..52239af 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,25 +1,17 @@
-# Security Policy
+Two main ways to responsibly report security issues privately:
-## Reporting a Vulnerability
-
-To report security issues, send an email to the addresses listed below.
-(Not for support. Support requests will be *ignored*.)
-
-Please send any report to *all* emails listed here.
-
-The following GPG keys may be used to communicate sensitive information.
+1. (preferred) if you have a GitHub account, use the built-in
+ ["Report a vulnerability"](https://github.com/spesmilo/electrum/security/advisories/new)
+ flow, or
+2. you can send an email to the addresses listed below.
+ (Not for support. Support requests will be *ignored*.)
+If using email, please send any report to *all* emails listed here.
| Name | Email | GPG fingerprint |
|-------------|----------------------------------------|---------------------------------------------------|
| ThomasV | thomasv [AT] electrum [DOT] org | 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6 |
| SomberNight | somber.night [AT] protonmail [DOT] com | 4AD6 4339 DFA0 5E20 B3F6 AD51 E7B7 48CD AF5E 5ED9 |
-
-#### Where to find GPG keys
-
-You can import a key by running the following command with that
-individual’s fingerprint: `gpg --recv-keys "<fingerprint>"`
-
-These public keys can also be found in the Electrum git repository,
+These GPG public keys can be found in the Electrum git repository,
in the top-level `pubkeys` folder.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.