Merge pull request #987 from newtonick/add-security-md
What the developer wrote
Authored by Nick Klockenga
Merge pull request #987 from newtonick/add-security-md
Add SECURITY.md with vulnerability disclosure policy
What changed, and why it matters
This commit adds a SECURITY.md file to the repository. It is purely a policy document that tells people how to privately report security bugs and what information to include. It does not change any code, fix any vulnerability, or introduce any new functionality.
No security action required. This is a documentation-only addition. Review the policy text for accuracy and completeness if desired.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit creates a single new markdown file, SECURITY.md, containing a vulnerability disclosure policy. It lists private email contacts for security reports, a subject-line format, expected response/patch timelines, and the scope of the policy. No source code, build scripts, dependencies, or configuration files are modified.
Changed components
Inspect captured patch +26 / −0
### SECURITY.md
@@ -0,0 +1,26 @@
+# Security policy
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Please report any vulnerability or any bug that could potentially affect the security of users' funds by mail to:
+
+- [`kdmukai.vision749@passmail.net`](mailto:kdmukai.vision749@passmail.net)
+- [`nick@klockenga.net`](mailto:nick@klockenga.net)
+
+In the subject type `[SeedSigner] Security Report: <short description>`
+and in the body a long description describing the issue. We aim to respond
+within one week and patch within 90 days.
+
+### What to include
+
+To help triage the report quickly, please include as much of the following as you can:
+
+- The SeedSigner version
+- A description of the vulnerability and its impact
+- Steps to reproduce, ideally with a proof of concept
+
+## Scope
+
+This policy covers SeedSigner and related build repos (ie seedsigner-os).
\ No newline at end of fileWhy this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.