Skip to content

Update security policy #9552

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aclark4life merged 4 commits into from
Apr 8, 2026
+4 −2
Merged

Update security policy #9552

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ab02e81
Update security policy
aclark4life Apr 8, 2026
0586077
Update .github/SECURITY.md
aclark4life Apr 8, 2026
8edb773
Update .github/SECURITY.md
aclark4life Apr 8, 2026
8f625f1
Update .github/SECURITY.md
aclark4life Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# Security policy

To report sensitive vulnerability information, please use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.
To report sensitive vulnerability information, report it [privately on GitHub](https://github.com/python-pillow/Pillow/security).
Copy link
Copy Markdown
Member

@radarhere radarhere Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When logged out, if you go to https://github.com/python-pillow/Pillow/security now, you see this file, and clicking on 'privately on GitHub' just reloads the page.

Shouldn't this be the link used by the 'Report a vulnerability' button? https://github.com/python-pillow/Pillow/security/advisories/new

Copy link
Copy Markdown
Member Author

@aclark4life aclark4life Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably yes and sorry, was going to send a new PR, but accidentally committed to main: b97034a.


If your organisation/employer is a distributor of Pillow and would like advance notification of security-related bugs, please let us know your preferred contact method.
If you cannot use GitHub, use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.

DO NOT report sensitive vulnerability information in public.
Loading