From 750ca85e3f1d9d8cfe632a29b12b2b261d0b8df3 Mon Sep 17 00:00:00 2001 From: kp2pml30 Date: Thu, 27 Aug 2026 17:07:33 +0900 Subject: [PATCH] =?UTF-8?q?docs(security):=20clarify=20pre-mainnet=20repor?= =?UTF-8?q?ting=20=F0=9F=93=9D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- SECURITY.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 18fc2c07..8dbccc9b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,9 +7,13 @@ This repository is a component of [genvm-manager]; the canonical security policy ## Reporting a vulnerability -**Do not open a public issue.** Report privately via GitHub's -[private vulnerability reporting](https://github.com/genlayerlabs/genvm-manager/security/advisories/new), -or email kira@genlayerlabs.com +**Before mainnet, report everything except remote code execution publicly** — open a +regular issue. Until there is value at stake, an open report gets triaged faster and is +useful to everyone reading along. RCE is the only exception; report it privately. + +For remote code execution, **do not open a public issue** — report it via GitHub's +[private vulnerability reporting](https://github.com/genlayerlabs/genvm-manager/security/advisories/new) +on the [genvm-manager] repository. Include a description, affected component/version, and a reproduction (a contract, calldata, or test case) where possible. We aim to acknowledge within a few business days.