From f5759022f08f1c1388a22fb0d1cd17dfaaadaeb7 Mon Sep 17 00:00:00 2001 From: Bulat Yapparov Date: Wed, 21 Oct 2026 08:44:31 +0100 Subject: [PATCH] docs: add private vulnerability reporting policy --- SECURITY.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d4e6a35 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,16 @@ +# Security policy + +## Report a vulnerability + +Report suspected vulnerabilities in aictrl CLI through [GitHub private vulnerability reporting](https://github.com/aictrl-dev/cli/security/advisories/new). You can also open this repository's Security and quality tab and choose **Report a vulnerability**. + +Please include: + +- The affected CLI version and relevant operating system or runtime details. +- A minimal reproduction and the observed behavior. +- The potential security impact. +- Sanitized logs or examples that help reproduce the problem. + +Do not post exploit details, credentials, tokens, or private data in public issues. Remove secrets and personal data from any logs or examples you share. + +For ordinary bugs without a suspected security impact, use the [public issue tracker](https://github.com/aictrl-dev/cli/issues).