From 5ddc91f81790439caa90212cd9e1a10eaccd3f24 Mon Sep 17 00:00:00 2001 From: Andrew Williamson Date: Mon, 17 Aug 2026 12:56:50 +0100 Subject: [PATCH] Create SECURITY.md --- SECURITY.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3e440d1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,23 @@ +## Overview + +We welcome reports from the security community and are committed to working collaboratively to investigate and resolve vulnerabilities responsibly. + +--- + +## Reporting a Potential Vulnerability + +If you find a security vulnerability please submit details through our [bug bounty program](https://www.mozilla.org/en-US/security/web-bug-bounty/) [[FAQ](https://www.mozilla.org/en-US/security/bug-bounty/faq-webapp/)]. Always submit potential security vulnerabilities via the [webform](https://hackerone.com/mozilla); _never_ submit security-related bugs through a Github Issue or by email. + +### What to include + +To help us triage quickly, please provide: + +- A clear description of the issue +- Steps to reproduce (or a proof of concept) +- Affected versions / environments +- Potential impact (what an attacker could achieve) +- Any suggested mitigations or fixes + +### Non-security bugs + +Other bugs, that have no potential security implications, can be submitted via our [addons issue tracker](https://github.com/mozilla/addons/issues/new/choose).