From fcbe3ed58e218312be8d634171374b37344456f4 Mon Sep 17 00:00:00 2001 From: Gary Jones Date: Fri, 9 Oct 2026 07:51:27 +0100 Subject: [PATCH] docs: add a security policy pointing to HackerOne Automattic triages vulnerability reports through its HackerOne programme, which is also where the bug bounty runs. The repo had no policy, so researchers had no guidance on where to report, and GitHub private vulnerability reporting (now turned off) offered a channel that bypassed both. The wording is shared by every VIP-maintained plugin. It lives in .github/, which is already excluded from release archives and WordPress.org. --- .github/SECURITY.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/SECURITY.md diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 0000000..697d801 --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1,19 @@ +# Security Policy + +## Supported Versions + +Security fixes are made in the latest release only. + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub issues or pull requests.** + +Report them through Automattic's HackerOne programme instead: https://hackerone.com/automattic + +Reporting through HackerOne can also make you eligible for Automattic's bug bounty. Please read the [bounty eligibility guidelines](https://hackerone.com/automattic) before submitting reports. + +Please include: + +- a description of the vulnerability and its impact +- steps to reproduce it +- a suggested fix, if you have one