Skip to content

docs: Add SECURITY.md #243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Tiryoh wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: Add SECURITY.md #243

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
# Security Policy

## Supported Versions

| Version | Supported |
| ------- | ------------------ |
| latest | :white_check_mark: |

Only the latest release is supported with security updates.

## Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it through [GitHub Security Advisories](https://github.com/Tiryoh/actions-mkdocs/security/advisories/new).

### Before Reporting

- **Search existing advisories** to ensure the issue has not already been reported.
- **Verify the vulnerability** by providing a clear proof of concept or reproduction steps.
- **One report per vulnerability** — please do not submit multiple reports for the same or closely related issues.

### What to Include

- A clear description of the vulnerability
- Steps to reproduce the issue
- The potential impact
- Suggested fix (if any)

### What to Expect

- If you do not receive any response within 3 days, please open a public issue to let us know that you have submitted a security advisory. Do not include vulnerability details in the issue — just notify us that a report is pending.
- Duplicate, AI-generated, or low-quality reports without a valid proof of concept may be closed without further response.

## Scope

This security policy covers the `actions-mkdocs` GitHub Action itself. Vulnerabilities in upstream dependencies (e.g., MkDocs, mkdocs-material) should be reported to their respective projects.