From 0e74622733b35c68fc5b0dbdaeb50202d23e81dc Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 6 Aug 2026 12:05:07 -0700 Subject: [PATCH] Add an organization-wide security policy GitHub falls back to this repository for any ruby/* repo that has no SECURITY.md of its own, so one file here gives every library in the organization a Report a vulnerability path. Today most of them have none. A reporter looking at ruby/zlib, ruby/psych or ruby/openssl sees no policy and no private reporting, and the reasonable guess is to open an issue -- which is the one thing we do not want. Content follows https://www.ruby-lang.org/en/security/ and adds nothing new: HackerOne or security@ruby-lang.org, the PGP key, do not open a public issue, valid reports are published after a fix. Website and third-party gem reports are pointed elsewhere. Japanese readers are pointed at the Japanese version of the same page. --- SECURITY.md | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..60c9226 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,44 @@ +# Security Policy + +This policy applies to the repositories in this organization: the Ruby +interpreter, the standard library, default and bundled gems, and the developer +tools maintained here. + +日本語版は [ruby-lang.org のセキュリティページ](https://www.ruby-lang.org/ja/security/) +をご覧ください。 + +## How to report a vulnerability + +Please use one of these two channels: + +- **HackerOne** — +- **Email** — + +You may encrypt your email. The PGP public key is at +. + +**Please do not open a public issue or a public pull request for a security +problem.** A public report tells everyone about the problem before a fix +exists. Use HackerOne or email instead. + +This includes libraries that live in their own repository here. For example, a +problem in `ruby/openssl` or `ruby/psych` is a problem in Ruby, because those gems +ship with Ruby. Please report it through the channels above, not in the +library's issue tracker. + +## What happens next + +- The Ruby security team reviews your report. +- Valid problems are published after a fix is ready. +- Please read the scope notes on the [HackerOne program + page](https://hackerone.com/ruby) before you report. + +## Not covered by this policy + +- **The website.** Report problems in . +- **Gems that are not part of Ruby.** Follow the [RubyGems.org security + instructions](https://guides.rubygems.org/security/). + +## More information + +