docs: SECURITY.md says how to report a vulnerability

2026-10-13 23:26:51 +02:00
3 changed files with 13 additions and 2 deletions
@@ -92,7 +92,7 @@ use most:
  secret
 - [Config](docs/config.md): every option, themes, layered configs, the
  state file
- [Development](docs/development.md): building, tests, pull requests and
+- [Development](docs/development.md): building, tests, how changes land and
  releasing
 ## Privacy
@@ -0,0 +1,11 @@
 # Security
 Please report a vulnerability privately, not in a public issue:
 - on GitHub, with **Report a vulnerability** under the
  [Security tab](https://github.com/karleinarb/lazysecrets/security), or
 - by email to karl-einarb@outlook.com.
 Say what's affected, how to reproduce it and the version
 (`lazysecrets --version`). Fixes go into the next release, and only the
 latest release gets them.
@@ -22,7 +22,7 @@ Development builds show `dev-<commit>` as their version (`-dirty` with
 uncommitted changes); `go install …@v0.2.0` shows the tag, releases the
 version they were built for.
-## Pull requests
+## How changes land
 Pull requests into `main` are squash-merged, so each is one commit titled
 like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)