From 97777140c6f4542d5ff8c5b6b4b2fff94eaaf215 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 28 Sep 2026 21:55:36 -0400 Subject: [PATCH] Route vulnerability reports through private reporting and security@ Private vulnerability reporting is enabled on this repository, so it is the preferred channel; security@simtabi.com is the fallback for reporters without a GitHub account, replacing the community inbox. --- SECURITY.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 3b9d905..3d9d267 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,11 @@ ## Reporting a vulnerability -Email **security@simtabi.com**. Do not open a public GitHub issue. +Use GitHub private vulnerability reporting: open a private report at +. The report stays +attached to the repository, with a draft advisory and a CVE request path. If you +do not use GitHub, email **security@simtabi.com**. Do not open a public GitHub +issue. Acknowledgement within 48 hours. Patch SLA: 14 days for severity ≤ 3, 30 days for severity 4. Coordinated disclosure with a default 90-day embargo from triage.