docs(security): direct vulnerability reports to private channel only#410
Merged
Conversation
The previous SECURITY.md had a "Reporting a Bug" section telling people to file security bugs as public GitHub issues, directly contradicting the private email path in the section below it. Anyone following the first instruction would publicly disclose a vulnerability before a fix existed. Restructure the policy so the private channel is the primary, prominent path with an explicit "do not report publicly" warning. Keep support@macpaw.com as the canonical contact, mention GitHub's private vulnerability reporting as a conditional option, and demote non-security bugs to their own section. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repository security policy to discourage public disclosure of vulnerabilities and direct reporters to private channels, reducing the risk of unpatched vulnerabilities being shared publicly.
Changes:
- Replaces the prior “report security bugs via issues” guidance with an explicit “do not report publicly” warning.
- Makes the private email channel the primary reporting path and optionally references GitHub private vulnerability reporting.
- Adds a short “what to include” checklist and separates non-security bug reporting into its own section.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
nezhyborets
approved these changes
Apr 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SECURITY.md, which directly contradicted the private email path below it. Anyone following that instruction would publicly disclose a vulnerability before a fix existed.support@macpaw.comas the canonical contact, and mentions GitHub's private vulnerability reporting as a conditional option (so the doc stays accurate whether or not the feature is enabled on the repo).No code changes; docs only.
Test plan
SECURITY.mdon GitHub and confirm the warning is prominent and links resolve.🤖 Generated with Claude Code