What the developer wrote
Authored by qlrd
docs: add `SECURITY.md` file (#817)
What changed, and why it matters
This commit only adds a SECURITY.md file to the repository. It is a documentation-only change that tells people how to report security bugs. It does not change any code, fix any vulnerability, or introduce any security risk.
No action required. This is a routine documentation addition.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit creates a new SECURITY.md file containing a security policy: a contact email (odudex@proton.me), a PGP key reference, instructions for the report subject line, and expected response/patch timelines. There are no code changes.
Changed components
Inspect captured patch +12 / −0
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..48fe208
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,12 @@
+# Security policy
+
+Please report any vulnerability or any bug that could potentially affect the
+security of users' funds by mail to
+[`odudex@proton.me`](mailto:odudex@proton.me).
+
+You may use the [PGP public](https://github.com/odudex.gpg) key to encrypt your
+mail.
+
+In the subject type `[Krux firmware] Security Report: <short description>`
+and in the body a long description describing the issue. We aim to respond
+within one week and patch within 90 days.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.