diff --git a/SECURITY.md b/SECURITY.md index 74593f78f..8312d20e4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,14 +2,14 @@ ## Supported Versions -| Version | Supported | -| ------- | ------------------ | -| <= 1.7 | :x: | -| 1.8.x | :white_check_mark: | -| 2.0.x | :white_check_mark: | +The .NET Core and ASP.NET Core support policy, including supported versions can be found at the [.NET Core Support Policy Page](https://dotnet.microsoft.com/platform/support/policy/dotnet-core). ## Reporting a Vulnerability -Please use email to contact the project's main contributors with any vulnerability you become aware of. +Security issues and bugs should be reported privately to the Microsoft Security Response Center (MSRC), either by emailing secure@microsoft.com or via the portal at https://msrc.microsoft.com. +You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your +original message. Further information, including the MSRC PGP key, can be found in the [MSRC Report an Issue FAQ](https://www.microsoft.com/en-us/msrc/faqs-report-an-issue). - Yoshifumi Kawai ; Andrew Arnott +Reports via MSRC may qualify for the .NET Core Bug Bounty. Details of the .NET Core Bug Bounty including terms and conditions are at [https://aka.ms/corebounty](https://aka.ms/corebounty). + +Please do not open issues for anything you think might have a security implication.