Revise security policy and reporting instructions#5096
Merged
theCyberTech merged 3 commits intomainfrom Mar 26, 2026
Merged
Conversation
Updated the security reporting process and contact details.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repository’s security policy to reflect a revised vulnerability reporting process and updated contact details.
Changes:
- Simplifies the SECURITY policy text to a shorter statement of intent.
- Switches reporting instructions to a Bugcrowd submission email.
- Adds explicit guidance not to disclose vulnerabilities publicly and to use the designated reporting path.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
iris-clawd
approved these changes
Mar 26, 2026
Contributor
iris-clawd
left a comment
iris-clawd
left a comment
There was a problem hiding this comment.
Looks good — clean swap to the Bugcrowd VDP. All the detailed reporting guidance (scope, safe harbor, etc.) lives on the Bugcrowd side now so removing it from the repo makes sense. 👍
iris-clawd
added a commit
that referenced
this pull request
Mar 26, 2026
Add a 'Reporting Security Vulnerabilities' section to the MCP security documentation across all languages (en, pt-BR, ko, ar) directing users to report via the Bugcrowd VDP (crewai-vdp-ess@submit.bugcrowd.com). This aligns the docs with the updated security policy from PR #5096, which transitioned vulnerability reporting to Bugcrowd.
iris-clawd
added a commit
that referenced
this pull request
Mar 26, 2026
Create a dedicated Security Policy page (docs/{en,pt-BR,ko,ar}/security.mdx)
with vulnerability reporting instructions pointing to the Bugcrowd VDP
(crewai-vdp-ess@submit.bugcrowd.com), consistent with the updated security
policy from PR #5096.
The page is added to the Documentation tab navigation (after Telemetry)
across all versions and languages in docs.json.
This is a top-level security page, not buried inside MCP docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated the security reporting process and contact details.