diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..9631421 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,53 @@ +# Security Policy + +## Supported Versions + +The following versions of **MergeShip** are currently supported with security updates: + +| Version | Supported | +| ------- | --------- | +| main | ✅ Yes | + +## Contact Details + +To report a security vulnerability in **MergeShip**, please reach out via: + +- 👤 Github: [Coder's OG's](https://github.com/Coder-s-OG-s) +- ✉️ Email: codersogs@gmail.com +- 💬 Discord: [Server](https://discord.gg/Wg4xZt3DRx) +- 💬 LinkedIN: [Coder's OG's](https://www.linkedin.com/company/coder-s-og/) + +> Please **do not** open a public GitHub issue for security vulnerabilities. + +## What to Include in Your Report + +- A clear description of the vulnerability +- Steps to reproduce the issue +- Affected versions or components +- Potential impact assessment +- Any suggested fix (optional but appreciated) + +## Expected Response Time + +| Action | Timeframe | +| ------------------------- | --------------- | +| Acknowledgement of report | Within 48 hours | +| Status update | Within 7 days | +| Patch / fix release | Within 30 days | + +## Responsible Disclosure Policy + +We follow a **responsible disclosure** policy: + +- Please report vulnerabilities **privately** before any public disclosure +- We request an **embargo period of 30 days** to investigate and patch the issue +- After a fix is released, you are welcome to publish your findings +- We will credit reporters in the patch notes unless anonymity is requested +- We deeply appreciate the efforts of security researchers 🙏 + +## References + +- [MergeShip Repository](https://github.com/Coder-s-OG-s/MergeShip) +- [GitHub Security Advisories Docs](https://docs.github.com/en/code-security/security-advisories) +- [Responsible Disclosure — OWASP](https://owasp.org/www-community/Vulnerability_Disclosure_Cheat_Sheet) +- [Adding a Security Policy to your repo](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository)