diff --git a/SECURITY.md b/SECURITY.md index 6340c409..5e4baab1 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,11 +7,28 @@ | 0.x.x | :white_check_mark: | | 1.x.x | :white_check_mark: | -## Reporting a Bug +## Reporting a Vulnerability -Report security bugs by creating [issues](https://github.com/MacPaw/OpenAI/issues). +**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.** -## Reporting a Vulnerability +Report (suspected) security vulnerabilities privately to +**[support@macpaw.com](mailto:support@macpaw.com)**. + +If [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) +is enabled on the repository, you can also use the +["Security"](https://github.com/MacPaw/OpenAI/security) tab and click +the **Report a vulnerability** button. + +Please include: + +- A description of the issue and its potential impact. +- Steps to reproduce, a proof-of-concept, or affected code paths. +- The version(s) of the library you tested against. + +We will acknowledge your report, investigate, and coordinate a fix and +disclosure timeline with you. + +## Reporting Non-Security Bugs -Please report (suspected) security vulnerabilities to -**[support@macpaw.com](mailto:support@macpaw.com)**. +For non-security bugs, please open a regular +[GitHub issue](https://github.com/MacPaw/OpenAI/issues).