Skip to content

docs: updated SECURITY.md #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fredbi merged 1 commit into from
Mar 2, 2026
Merged

docs: updated SECURITY.md #182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ You may also join our discord server where you may discuss issues or requests.
[![Discord Server][discord-badge]][discord-url]

[discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
[discord-url]: https://discord.gg/DrafRmZx
[discord-url]: https://discord.gg/twZ9BwT3

### Reporting issues

Expand Down
28 changes: 23 additions & 5 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,32 @@ This policy outlines the commitment and practices of the go-openapi maintainers

| Version | Supported |
| ------- | ------------------ |
| 0.25.x | :white_check_mark: |
| O.x | :white_check_mark: |

## Vulnerability checks in place

This repository uses automated vulnerability scans, at every merged commit and at least once a week.

We use:

* [`GitHub CodeQL`][codeql-url]
* [`trivy`][trivy-url]
* [`govulncheck`][govulncheck-url]

Reports are centralized in github security reports and visible only to the maintainers.

## Reporting a vulnerability

If you become aware of a security vulnerability that affects the current repository,
please report it privately to the maintainers.
**please report it privately to the maintainers**
rather than opening a publicly visible GitHub issue.

Please follow the instructions provided by github to [Privately report a security vulnerability][github-guidance-url].

Please follow the instructions provided by github to
[Privately report a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
> [!NOTE]
> On Github, navigate to the project's "Security" tab then click on "Report a vulnerability".

TL;DR: on Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
[codeql-url]: https://github.com/github/codeql
[trivy-url]: https://trivy.dev/docs/latest/getting-started
[govulncheck-url]: https://go.dev/blog/govulncheck
[github-guidance-url]: https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability
Loading