From 51e77c29a33d6a3a1e11a827457b99462323e96b Mon Sep 17 00:00:00 2001 From: Dan Rosser Date: Mon, 2 Nov 2026 22:28:13 +1100 Subject: [PATCH] Add SECURITY.md for private vulnerability reports Point reporters at the projectGenerator security advisory form, and keep of@openframeworks.cc as the fallback contact. --- SECURITY.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..8fdab1df --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,28 @@ +# Security Policy + +## Reporting a Vulnerability + +Report security vulnerabilities in private. A public GitHub issue, discussion, or pull request is public disclosure. + +Use **Report a vulnerability** on the security advisories page: + + + +If you cannot use that form, email **of** at **openFrameworks** [**.cc**]. + +This policy covers the projectGenerator command line tool, the desktop app, the scripts in this repository, and the packages published on the [releases](https://github.com/openframeworks/projectGenerator/releases) page. + +Report a vulnerability in openFrameworks itself through the [openFrameworks security policy](https://github.com/openframeworks/openFrameworks/security/policy). + +Please include: + +- the projectGenerator version or commit, and whether you used the command line tool or the desktop app +- the operating system, and the release package if you installed one (for example the nightly zip) +- what the issue is, and what the impact is +- steps to reproduce, or a proof of concept, when you have one + +Maintainers will confirm the report on the advisory and coordinate a fix before publishing it. + +## Supported versions + +Please report against `master` or the [nightly release](https://github.com/openframeworks/projectGenerator/releases/tag/nightly). Fixes are committed to `master` and published in the nightly release.