From 2f353f10a51a98d6272e95270da4127abbff5f6e Mon Sep 17 00:00:00 2001 From: Gary Jones Date: Fri, 9 Oct 2026 07:51:27 +0100 Subject: [PATCH] docs: standardise the security policy and move it to .github Every VIP-maintained plugin now carries the same policy, routing reports to HackerOne and pointing reporters to the bounty eligibility rules first, so this replaces the plugin-specific wording. The file moves to .github/, which GitHub reads just as it does the root and which is already excluded from release archives and WordPress.org. The SECURITY.md exclusion in .distignore is no longer needed. The README and CONTRIBUTING links follow it; the README uses GitHub's security policy URL, which resolves wherever the file lives. --- .distignore | 1 - .github/SECURITY.md | 19 +++++++++++++++++++ CONTRIBUTING.md | 2 +- README.md | 2 +- SECURITY.md | 15 --------------- 5 files changed, 21 insertions(+), 18 deletions(-) create mode 100644 .github/SECURITY.md delete mode 100644 SECURITY.md diff --git a/.distignore b/.distignore index 53d2bcd..6136d32 100644 --- a/.distignore +++ b/.distignore @@ -19,7 +19,6 @@ AGENTS.md CHANGELOG.md CONTRIBUTING.md -SECURITY.md composer.json composer.lock mixtape.json diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 0000000..697d801 --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1,19 @@ +# Security Policy + +## Supported Versions + +Security fixes are made in the latest release only. + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub issues or pull requests.** + +Report them through Automattic's HackerOne programme instead: https://hackerone.com/automattic + +Reporting through HackerOne can also make you eligible for Automattic's bug bounty. Please read the [bounty eligibility guidelines](https://hackerone.com/automattic) before submitting reports. + +Please include: + +- a description of the vulnerability and its impact +- steps to reproduce it +- a suggested fix, if you have one diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 591d40a..d12d40a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -8,7 +8,7 @@ Thanks for your interest in contributing. This document covers the practical bit |---|---| | Bug report | [GitHub issue](https://github.com/Automattic/zoninator/issues) | | Feature request | [GitHub issue](https://github.com/Automattic/zoninator/issues) | -| Security vulnerability | [HackerOne](https://hackerone.com/automattic) — see [SECURITY.md](SECURITY.md) | +| Security vulnerability | [HackerOne](https://hackerone.com/automattic) — see [SECURITY.md](.github/SECURITY.md) | | Support question | [WordPress.org support forum](https://wordpress.org/support/plugin/zoninator/) | ## Filing a useful bug report diff --git a/README.md b/README.md index ed6680f..ba0a8ab 100644 --- a/README.md +++ b/README.md @@ -68,7 +68,7 @@ Audience-targeted documentation lives in the GitHub repository: * [Hooks reference](https://github.com/Automattic/zoninator/blob/main/docs/hooks.md) — every filter and action the plugin exposes. * [REST API](https://github.com/Automattic/zoninator/blob/main/docs/rest-api.md) — endpoints under the `zoninator/v1` namespace, for headless integrations. * [Contributing](https://github.com/Automattic/zoninator/blob/main/CONTRIBUTING.md) — local setup, tests, and PR conventions. -* [Security](https://github.com/Automattic/zoninator/blob/main/SECURITY.md) — responsible disclosure. +* [Security](https://github.com/Automattic/zoninator/security/policy) — responsible disclosure. ## Frequently Asked Questions diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index cca8011..0000000 --- a/SECURITY.md +++ /dev/null @@ -1,15 +0,0 @@ -# Security Policy - -> Although we strive to create the most secure products possible, we are not perfect. If you happen to find a security vulnerability in one of our services, we would appreciate letting us know and allowing us to respond before disclosing the issue publicly. We take security seriously, and we will try to review and reply to every legitimate security report personally within 24 hours. - -([Source](https://automattic.com/security/)) - -## Reporting a Vulnerability - -For responsible disclosure of security issues and to be eligible for our bug bounty program, please submit security issues via the HackerOne portal: https://hackerone.com/automattic - -Please do not open public GitHub issues for security reports. - -## Supported Versions - -Security fixes are issued against the latest minor release of Zoninator. Earlier versions do not receive backports. The current supported version is listed in the [README](README.md) and on [WordPress.org](https://wordpress.org/plugins/zoninator/).