From 7e5361c969f547b447d8215033a921fe85906a43 Mon Sep 17 00:00:00 2001 From: Fury03 Date: Thu, 30 Jul 2026 01:11:44 +0100 Subject: [PATCH] docs(security): state response-time SLA in the security issue template Closes #1091 --- .github/ISSUE_TEMPLATE/security.md | 10 ++++++++++ SECURITY.md | 6 +++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/ISSUE_TEMPLATE/security.md b/.github/ISSUE_TEMPLATE/security.md index 2781a384..d968af38 100644 --- a/.github/ISSUE_TEMPLATE/security.md +++ b/.github/ISSUE_TEMPLATE/security.md @@ -10,6 +10,16 @@ assignees: '' **For non-sensitive security-related issues only:** +### What to expect + +Per our [Security Policy](../../SECURITY.md#response-timeline), the same response timeline applies to reports filed here: + +- **Initial Response**: Within 48 hours of receiving your report +- **Status Update**: Within 7 days with our assessment and planned timeline +- **Resolution**: We aim to resolve critical vulnerabilities within 30 days + +If you have not heard from us within 48 hours, please ping the issue or reach out through our [community Telegram](https://t.me/+DOylgFv1jyJlNzM0). + ## Description A clear and concise description of the security concern. diff --git a/SECURITY.md b/SECURITY.md index 7db9a99b..4279194b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -46,6 +46,10 @@ We are committed to responding to security reports promptly: - **Status Update**: Within 7 days with our assessment and planned timeline - **Resolution**: We aim to resolve critical vulnerabilities within 30 days +These targets apply to every reporting channel — private GitHub Security Advisories and non-sensitive public reports filed with the [security issue template](.github/ISSUE_TEMPLATE/security.md), which restates the same timeline. If you update one, update the other so they do not drift. + +If you have not heard from us within 48 hours, please reach out through our [community Telegram](https://t.me/+DOylgFv1jyJlNzM0). + ### Disclosure Policy - We follow responsible disclosure practices @@ -106,7 +110,7 @@ Security updates and advisories will be published: For security-related questions or concerns that are not vulnerabilities, you can: -- Open a public issue with the `security` label +- Open a public issue with the `security` label using the [security issue template](.github/ISSUE_TEMPLATE/security.md) - Reach out to the maintainers through GitHub - Join our community discussions