From bbb8eb9a06aac24c4a702bb168973a802b5478a3 Mon Sep 17 00:00:00 2001 From: kkdev92 <112151103+kkdev92@users.noreply.github.com> Date: Thu, 13 Aug 2026 01:37:05 +0900 Subject: [PATCH] docs: link the vulnerability report form instead of describing it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Scorecard scores SecurityPolicy 4 of 10 with `Warn: no linked content found`, and the correlation across the four repositories here is exact: the two with no links in SECURITY.md are flagged, the two with one are not. The link is worth more than the score. The policy said "use the Report a vulnerability button in the Security tab", which describes where a feature lives rather than taking someone there — and private reporting was only enabled today, so `…/security/advisories/new` is now a real door. Someone holding a vulnerability should not have to go looking for it. It also now says that reporting is private, which is the reason not to open an issue and was left implicit before. Co-Authored-By: Claude Opus 5 --- SECURITY.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 6b7be7b..ef37719 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -16,8 +16,12 @@ valid answer. ## Reporting a vulnerability 1. **Do not open a public issue.** -2. Use GitHub's **Report a vulnerability** button in the repository's Security - tab. +2. Open a private report: + + + That is the **Report a vulnerability** button in the repository's Security + tab; the link goes straight to it. Private reporting is enabled, so the + advisory stays between us until there is a fix to describe. Please include the version, the extension host (desktop or web), and the smallest reproduction you have. A failing test against the Test Host is ideal.