Skip to content

docs: add vulnerability remediation timeline to SECURITY.md #233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WilliamBerryiii merged 2 commits into from
Mar 17, 2026
Merged

docs: add vulnerability remediation timeline to SECURITY.md #233

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5d8e466
docs: add vulnerability remediation timeline to SECURITY.md
WilliamBerryiii Mar 14, 2026
bbd0f3a
Merge branch 'main' into security/add-vulnerability-fix-timeline
WilliamBerryiii Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,17 @@ Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https:

<!-- END MICROSOFT SECURITY.MD BLOCK -->

## Vulnerability Remediation

The project maintainers commit to remediating confirmed vulnerabilities based on severity:

| Severity | Remediation Target |
|-------------------|--------------------|
| Critical and High | 60 days |
| Medium | 90 days |

Remediation timelines begin when the vulnerability is confirmed and may involve a code fix, configuration change, dependency update, or documented mitigation. Tracking is done through GitHub Security Advisories or GitHub issues. If a fix requires more time, the maintainers will publish a mitigation or workaround within the target window and document the extended timeline.

## Security Considerations for Deployers

> [!IMPORTANT]
Expand Down
Loading