docs: SECURITY.md says how to report a vulnerability

2026-10-13 22:36:53 +02:00
3 changed files with 13 additions and 2 deletions
@@ -92,7 +92,7 @@ use most:
  secret
 - [Config](docs/config.md): every option, themes, layered configs, the
  state file
- [Development](docs/development.md): building, tests, pull requests and
+- [Development](docs/development.md): building, tests, how changes land and
  releasing

 ## Privacy
@@ -0,0 +1,11 @@
+# Security
+
+Please report a vulnerability privately, not in a public issue:
+
+- on GitHub, with **Report a vulnerability** under the
+  [Security tab](https://github.com/karleinarb/lazysecrets/security), or
+- by email to karl-einarb@outlook.com.
+
+Say what's affected, how to reproduce it and the version
+(`lazysecrets --version`). Fixes go into the next release, and only the
+latest release gets them.
@@ -22,7 +22,7 @@ Development builds show `dev-<commit>` as their version (`-dirty` with
 uncommitted changes); `go install …@v0.2.0` shows the tag, releases the
 version they were built for.

-## Pull requests
+## How changes land

 Pull requests into `main` are squash-merged, so each is one commit titled
 like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)