8000 chore: add SECURITY.md by nfischer · Pull Request #1061 · shelljs/shelljs · GitHub
[go: up one dir, main page]
Skip to content

chore: add SECURITY.md #1061

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jan 7, 2022
Merged

chore: add SECURITY.md #1061

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ab04185
chore: add SECURITY.md
nfischer Jan 7, 2022
e264403
Add a little more and reformat
nfischer Jan 7, 2022
b062c21
Reword a sentence
nfischer Jan 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
# ShellJS Security Policy

Thank you for reaching out regarding the security of the ShellJS module! Please
note that this project is maintained on a best-effort basis, however I still
intend to prioritize reviewing and addressing security issues.

## Supported Versions

I generally only support the latest ShellJS release (see
https://www.npmjs.com/package/shelljs). My goal is to release security fixes as
patch releases on top of whatever was most recently shipped.

If breaking changes have already landed on the main development branch, I may
apply the patch on the relevant release branch (ex.
[`0.8-release`](https://github.com/shelljs/shelljs/commits/0.8-release) and
create a new release from there.

## Reporting a Vulnerability

Please report security vulnerabilities to ntfschr@gmail.com. I should respond
within a few days. Although it's not strictly required, it helps me out if you
can include any proof of concept exploit code, suggested fix, etc.

**Please do not publicly disclose the suspected vulnerability** until I have a
chance to review your report. I'd like a chance to patch the code before the
issue is known to the public.

Please **only** use this email for security issues. It's also OK to use the
email if you're legitimately unsure if this is a security issue (better safe
than sorry). But for all other non-security issues, please use the GitHub issue
tracker.
0