doc: allow for holidays in triage response

Signed-off-by: Michael Dawson <[email protected]> PR-URL: nodejs#45267 Reviewed-By: Gireesh Punathil <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
lucshi · Nov 9, 2022 · 46e22a2 · 46e22a2
1 parent 2c330f8
commit 46e22a2
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/SECURITY.md b/SECURITY.md
@@ -4,9 +4,11 @@
 
 Report security bugs in Node.js via [HackerOne](https://hackerone.com/nodejs).
 
-Your report will be acknowledged within 5 days, and you'll receive a more
-detailed response to your report within 10 days indicating the next steps in
-handling your submission.
+Normally your report will be acknowledged within 5 days, and you'll receive
+a more detailed response to your report within 10 days indicating the
+next steps in handling your submission. These timelines may extend when
+our triage volunteers are away on holiday, particularly at the end of the
+year.
 
 After the initial reply to your report, the security team will endeavor to keep
 you informed of the progress being made towards a fix and full announcement,