From 40d98189dad351e9ff7e603dc2c1b31b34377d71 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Karl-Einar=20Bergstr=C3=B8m?= Date: Tue, 13 Oct 2026 22:36:53 +0200 Subject: [PATCH] docs: SECURITY.md says how to report a vulnerability --- README.md | 2 +- SECURITY.md | 11 +++++++++++ docs/development.md | 2 +- 3 files changed, 13 insertions(+), 2 deletions(-) create mode 100644 SECURITY.md diff --git a/README.md b/README.md index 3cdb393..f6fad48 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,7 @@ use most: secret - [Config](docs/config.md): every option, themes, layered configs, the state file -- [Development](docs/development.md): building, tests, pull requests and +- [Development](docs/development.md): building, tests, how changes land and releasing ## Privacy diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..9b5bee1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,11 @@ +# Security + +Please report a vulnerability privately, not in a public issue: + +- on GitHub, with **Report a vulnerability** under the + [Security tab](https://github.com/karleinarb/lazysecrets/security), or +- by email to karl-einarb@outlook.com. + +Say what's affected, how to reproduce it and the version +(`lazysecrets --version`). Fixes go into the next release, and only the +latest release gets them. diff --git a/docs/development.md b/docs/development.md index 9fdede4..6ebdcd5 100644 --- a/docs/development.md +++ b/docs/development.md @@ -22,7 +22,7 @@ Development builds show `dev-` as their version (`-dirty` with uncommitted changes); `go install …@v0.2.0` shows the tag, releases the version they were built for. -## Pull requests +## How changes land Pull requests into `main` are squash-merged, so each is one commit titled like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)