diff options
| author | Tuowen Zhao <ztuowen@gmail.com> | 2021-12-18 17:46:06 -0600 |
|---|---|---|
| committer | Tuowen Zhao <ztuowen@gmail.com> | 2021-12-18 17:46:06 -0600 |
| commit | 1bc186dabe12b3d01b2257e82f3a104c48b8b3c7 (patch) | |
| tree | 54576312318c406b6ce2a35423198fcc92c8bf71 /SECURITY.md | |
| parent | 2a977876c6e85847652f097cc128e4ed5bec147a (diff) | |
| parent | 904f8685f75ff5dd3f544f8c6f2cabb8e5952e9a (diff) | |
| download | zsh-1bc186dabe12b3d01b2257e82f3a104c48b8b3c7.tar.gz zsh-1bc186dabe12b3d01b2257e82f3a104c48b8b3c7.tar.bz2 zsh-1bc186dabe12b3d01b2257e82f3a104c48b8b3c7.zip | |
Merge remote-tracking branch 'origin/master'
Diffstat (limited to 'SECURITY.md')
| -rw-r--r-- | SECURITY.md | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/SECURITY.md b/SECURITY.md index cda53379f..7e5c8eed0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -3,7 +3,8 @@ ## Supported Versions At the moment Oh My Zsh only considers the very latest commit to be supported. -We combine that with our fast response to incidents, so risk is minimized. +We combine that with our fast response to incidents and the automated updates +to minimize the time between vulnerability publication and patch release. | Version | Supported | |:-------------- |:------------------ | @@ -14,9 +15,10 @@ In the near future we will introduce versioning, so expect this section to chang ## Reporting a Vulnerability -If you find a vulnerability, email all the maintainers directly at: +**Do not submit an issue or pull request**: this might reveal the vulnerability. -- Robby: robby [at] planetargon.com -- Marc: hello [at] mcornella.com +Instead, you should email the maintainers directly at: [**security@ohmyz.sh**](mailto:security@ohmyz.sh). -**Do not open an issue or Pull Request directly**, because it might reveal the vulnerability. +We will deal with the vulnerability privately and submit a patch as soon as possible. + +You can also submit your vulnerability report to [huntr.dev](https://huntr.dev/bounties/disclose/?utm_campaign=ohmyzsh%2Fohmyzsh&utm_medium=social&utm_source=github&target=https%3A%2F%2Fgithub.com%2Fohmyzsh%2Fohmyzsh) and see if you can get a bounty reward. |