From 3dd8163b25c1e3e4f4ac17a9f71abc03854567ec Mon Sep 17 00:00:00 2001 From: zumbrunn Date: Tue, 27 Oct 2026 13:54:27 +0100 Subject: [PATCH 1/2] docs: add SECURITY.md Describe how to report a vulnerability privately (GitHub private reporting), what to expect, and which versions get fixes. Co-Authored-By: Claude Sonnet 5.5 --- SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d414a29 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security policy + +## Reporting a vulnerability + +Please report security problems in @dune/plugin-admin **privately**, not through a public +issue, pull request, discussion or branch. + +Use GitHub's private reporting: open this repository's **Security** tab and +choose **Report a vulnerability**. That opens a confidential advisory that only +you and the maintainers can see. + +Include what you can of: + +- the affected version and how you run it (for Dune itself, `dune --version`), +- what the problem is and what an attacker could do with it, +- steps or a minimal example that reproduce it. + +You don't need a complete write-up or a fix; a clear description is enough to +start. + +## What to expect + +We read every report, confirm whether it is a vulnerability, and work on a fix +privately. Details are kept out of public commits, branches and the CHANGELOG +until a fixed release is available. When it ships, the release notes describe +the problem without a step-by-step recipe, and we credit the reporter if they +want that. + +## Supported versions + +Security fixes go into the latest release of `@dune/plugin-admin`; older versions are not patched, so upgrade to the newest version first. + +## Not security issues + +Ordinary bugs, hardening ideas that have no exploit, and questions belong in the +regular issue tracker. From e434d02a3942ae6f14f725c3fc53fc5b6110e4e2 Mon Sep 17 00:00:00 2001 From: zumbrunn Date: Tue, 27 Oct 2026 13:56:38 +0100 Subject: [PATCH 2/2] docs: deno fmt SECURITY.md Co-Authored-By: Claude Sonnet 5.5 --- SECURITY.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index d414a29..ee08193 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,8 +2,8 @@ ## Reporting a vulnerability -Please report security problems in @dune/plugin-admin **privately**, not through a public -issue, pull request, discussion or branch. +Please report security problems in @dune/plugin-admin **privately**, not through +a public issue, pull request, discussion or branch. Use GitHub's private reporting: open this repository's **Security** tab and choose **Report a vulnerability**. That opens a confidential advisory that only @@ -28,7 +28,8 @@ want that. ## Supported versions -Security fixes go into the latest release of `@dune/plugin-admin`; older versions are not patched, so upgrade to the newest version first. +Security fixes go into the latest release of `@dune/plugin-admin`; older +versions are not patched, so upgrade to the newest version first. ## Not security issues