summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPatrick Steinhardt <ps@pks.im>2019-05-24 15:39:25 +0200
committerGitHub <noreply@github.com>2019-05-24 15:39:25 +0200
commitbcb4d1d00c7306a4f368f6a1a3c63c2ae738aae9 (patch)
tree58f7927e5a6b1cfe533769787a64f167bccf7fef
parent2b8a05cc8ad1a9540ca690d1fe386123914e4922 (diff)
parent62bbec5a07d3dbd5beffd8d3bcb8115838d4a606 (diff)
downloadlibgit2-bcb4d1d00c7306a4f368f6a1a3c63c2ae738aae9.tar.gz
Merge pull request #5085 from pks-t/pks/security.md
SECURITY.md: split out security-relevant bits from readme
-rw-r--r--README.md4
-rw-r--r--SECURITY.md14
2 files changed, 15 insertions, 3 deletions
diff --git a/README.md b/README.md
index 4f697b1ad..c2830250b 100644
--- a/README.md
+++ b/README.md
@@ -103,9 +103,7 @@ We ask that you not open a GitHub Issue for help, only for bug reports.
**Reporting Security Issues**
-In case you think to have found a security issue with libgit2, please do not
-open a public issue. Instead, you can report the issue to the private mailing
-list [security@libgit2.com](mailto:security@libgit2.com).
+Please have a look at SECURITY.md.
What It Can Do
==============
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..f98eebf50
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,14 @@
+# Security Policy
+
+## Supported Versions
+
+This project will always provide security fixes for the latest two released
+versions. E.g. if the latest version is v0.28.x, then we will provide security
+fixes for both v0.28.x and v0.27.y, but no later versions.
+
+## Reporting a Vulnerability
+
+In case you think to have found a security issue with libgit2, please do not
+open a public issue. Instead, you can report the issue to the private mailing
+list [security@libgit2.com](mailto:security@libgit2.com). We will acknowledge
+receipt of your message in at most three days and try to clarify further steps.