From 74f1c18150245bd2ebdd9d4e4e40e76793dc2018 Mon Sep 17 00:00:00 2001 From: grloper Date: Fri, 9 Oct 2026 21:26:49 +0300 Subject: [PATCH] docs(security): document GitHub private vulnerability reporting flow --- SECURITY.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 65cc24b..c916f57 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,9 +6,13 @@ sensor, its trust ranges and its event destination as part of your security boun ## Reporting Do not disclose an unpatched bypass, memory-safety issue or destructive enforcement -bug in a public issue. Use the repository's [private vulnerability reporting page](https://github.com/grloper/Wraith/security/advisories/new) -if enabled. If unavailable, request a private reporting channel from the maintainer -without including exploit details. No response-time or bounty guarantee is offered. +bug in a public issue. Report it privately through GitHub's private vulnerability +reporting: open the repository's **Security** tab and choose **Report a vulnerability** +([direct link](https://github.com/grloper/Wraith/security/advisories/new)). This +creates a private security advisory visible only to you and the maintainers. + +If that page is unavailable, open a public issue that asks for a private channel and +contains no exploit details. No response-time or bounty guarantee is offered. Include the affected revision, Linux kernel, minimal safe reproducer, expected behavior, actual behavior and proposed regression. Do not send secrets or live