From 08248bb7cae7ce7c66fd28226fd3f8c7a8c7bc0a Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 28 Sep 2026 21:56:33 -0400 Subject: [PATCH] Name one reporting channel order in SECURITY.md, not two The private-reporting paragraph was added above the old email instruction, so the policy named security@simtabi.com twice and read as two competing instructions. Private reporting is the preferred channel and the address is its fallback; the rest of the section now applies to either. --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 6b9011b..d53b894 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -15,7 +15,7 @@ The preferred channel is GitHub private vulnerability reporting: open a private **Do not open a public GitHub issue for security problems.** -Disclosure goes to `security@simtabi.com`. Include: +Whichever channel you use, include: - A description of the vulnerability and its impact. - Steps to reproduce (minimum proof-of-concept).