docs: remove SECURITY.md to fall back to the organization default
What the developer wrote
Authored by Jan Komarek
docs: remove SECURITY.md to fall back to the organization default
What changed, and why it matters
This commit simply removes the repository's own SECURITY.md file and updates the README to point users to the organization's default security policy on GitHub instead. It is a documentation-only change with no code modifications and no direct security impact on the firmware or device.
No action required. Treat as routine repository maintenance. Optionally verify the organization-level GitHub security policy remains accurate and accessible.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit deletes SECURITY.md and edits README.md to replace the direct security@satoshilabs.com disclosure instructions with a link to the GitHub Security tab policy. No source code, build scripts, cryptographic logic, or device behavior is changed.
Changed components
README.mdSECURITY.mdInspect captured patch +1 / −8
diff --git a/README.md b/README.md
index e7eccba8..29cbc394 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ Also please have a look at the docs, either in the `docs` folder or at [docs.tr
## Security vulnerability disclosure
-Please report suspected security vulnerabilities in private to [security@satoshilabs.com](mailto:security@satoshilabs.com), also see [the disclosure section on the Trezor.io website](https://trezor.io/support/a/how-to-report-a-security-issue). Please do NOT create publicly viewable issues for suspected security vulnerabilities.
+Please do NOT create publicly viewable issues for suspected security vulnerabilities. See the [Security tab](https://github.com/trezor/trezor-firmware/security/policy) for reporting instructions.
## Documentation
diff --git a/SECURITY.md b/SECURITY.md
deleted file mode 100644
index 995109a4..00000000
--- a/SECURITY.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-Please report suspected security vulnerabilities in private to security@satoshilabs.com. Our guidance on this topic can be found at our [website](https://trezor.io/support/a/how-to-report-a-security-issue) and list of past issues at [GitHub](https://github.com/orgs/trezor/discussions).
-
-Thank you for your cooperation in making Trezor more secure.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.