diff --git a/SECURITY.md b/SECURITY.md index 7162e6d8c..23233ba5c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,12 +1,8 @@ # Security Policy -## Supported Versions +> [!warning] +> MaMpf is continuously deployed, so users will always get to work with the newest version.
That's why we will only release patches for the `main` branch. -We only release patches for the production branch. - -## Reporting a Vulnerability - -Please report (suspected) security vulnerabilities to -mampf-security@mathi.uni-heidelberg.de. You will receive a response from us -within 48 hours. If the issue is confirmed, we will release a patch as soon -as possible depending on complexity but usually within a few days. +- We are very grateful for any reports of security vulnerabilities in MaMpf. We take security very seriously and will respond to verified reports as soon as possible. +- Please don't report vulnerabilities in the public GitHub issue tracker. Instead, [**report them here privately on GitHub**](https://github.com/MaMpf-HD/mampf/security/advisories) and do NOT disclose them publicly until we have had a chance to address them. +- Note that we don't give out bounties for security vulnerabilities. We are a non-profit project and don't have the resources to pay for security reports. We are grateful for any reports and will acknowledge them in our release notes.