From 6bae77f1ce93230e94cf9a9afbf4e8ab874784f1 Mon Sep 17 00:00:00 2001 From: Stefan Haller Date: Sun, 8 Nov 2026 00:10:59 +0100 Subject: [PATCH] Add a security policy The repository doesn't say how to report a vulnerability privately, and #6185 was reported in a public issue. Point reporters to GitHub's private vulnerability reporting. Co-Authored-By: Claude Opus 5.5 --- SECURITY.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..0f074bd9e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,23 @@ +# Security Policy + +## Reporting a vulnerability + +Please don't report security vulnerabilities in public issues, discussions or pull requests. + +Instead, report them privately through GitHub. Go to the [Security tab](https://github.com/jesseduffield/lazygit/security) of this repository and click "Report a vulnerability". Only the maintainers can see your report. + +Please include: + +- the lazygit version (the output of `lazygit --version`) and your operating system +- the steps to reproduce the problem, ideally as a script that sets up a repository +- what an attacker can achieve with it + +## What happens next + +Lazygit is maintained by volunteers in their spare time. We can't promise a fixed response time, but we'll get back to you as soon as we can. + +If we confirm the vulnerability, we fix it in private and release a new version. Then we publish a security advisory, request a CVE for it through GitHub, and credit you in the advisory unless you prefer not to be named. + +## Supported versions + +We only fix security vulnerabilities in the latest release. Please check whether the problem still exists there before you report it.