From e67f661e5db550e6b323f1df7df0fff6305c1d9f Mon Sep 17 00:00:00 2001 From: zumbrunn Date: Tue, 27 Oct 2026 13:54:31 +0100 Subject: [PATCH 1/2] docs: add SECURITY.md Describe how to report a vulnerability privately (GitHub private reporting), what to expect, and which versions get fixes. Co-Authored-By: Claude Sonnet 5.5 --- SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..4b11542 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security policy + +## Reporting a vulnerability + +Please report security problems in @dune/plugin-inline-edit **privately**, not through a public +issue, pull request, discussion or branch. + +Use GitHub's private reporting: open this repository's **Security** tab and +choose **Report a vulnerability**. That opens a confidential advisory that only +you and the maintainers can see. + +Include what you can of: + +- the affected version and how you run it (for Dune itself, `dune --version`), +- what the problem is and what an attacker could do with it, +- steps or a minimal example that reproduce it. + +You don't need a complete write-up or a fix; a clear description is enough to +start. + +## What to expect + +We read every report, confirm whether it is a vulnerability, and work on a fix +privately. Details are kept out of public commits, branches and the CHANGELOG +until a fixed release is available. When it ships, the release notes describe +the problem without a step-by-step recipe, and we credit the reporter if they +want that. + +## Supported versions + +Security fixes go into the latest release of `@dune/plugin-inline-edit`; older versions are not patched, so upgrade to the newest version first. + +## Not security issues + +Ordinary bugs, hardening ideas that have no exploit, and questions belong in the +regular issue tracker. From 970839f48bcd20fe2b81d574a8b80587dfd85363 Mon Sep 17 00:00:00 2001 From: zumbrunn Date: Tue, 27 Oct 2026 13:56:43 +0100 Subject: [PATCH 2/2] docs: deno fmt SECURITY.md Co-Authored-By: Claude Sonnet 5.5 --- SECURITY.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 4b11542..27e04ad 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,8 +2,8 @@ ## Reporting a vulnerability -Please report security problems in @dune/plugin-inline-edit **privately**, not through a public -issue, pull request, discussion or branch. +Please report security problems in @dune/plugin-inline-edit **privately**, not +through a public issue, pull request, discussion or branch. Use GitHub's private reporting: open this repository's **Security** tab and choose **Report a vulnerability**. That opens a confidential advisory that only @@ -28,7 +28,8 @@ want that. ## Supported versions -Security fixes go into the latest release of `@dune/plugin-inline-edit`; older versions are not patched, so upgrade to the newest version first. +Security fixes go into the latest release of `@dune/plugin-inline-edit`; older +versions are not patched, so upgrade to the newest version first. ## Not security issues