From 85273f7f6ea882a32134e29d1d22e5cdd93ffe0f Mon Sep 17 00:00:00 2001 From: Alessandro Digilio Date: Sat, 31 Oct 2026 11:34:31 +0100 Subject: [PATCH 1/2] =?UTF-8?q?docs(security):=20=F0=9F=93=9D=20document?= =?UTF-8?q?=20private=20vulnerability=20reporting?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- SECURITY.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..2f3f81d --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,22 @@ +# Security policy + +## Reporting a vulnerability + +Use [GitHub private vulnerability reporting](https://github.com/alsd4git/mtls-cli/security/advisories/new). +Do not disclose exploit details or sensitive data in public issues or pull requests. + +Include the affected commit or version, expected impact and minimal reproduction +steps. Use synthetic examples and redact screenshots and logs. If a credential +has been exposed, revoke or rotate it before sharing details. + +## Versions and maintenance + +Check the current default branch, `main`, and, if using a release, +the latest release published by this repository before reporting an issue. +Fixes, when provided, target the default branch. Older versions do not receive +separate backports. Reports are handled on a best-effort basis without guaranteed +response or remediation times. + +## Safe reproduction + +Use temporary stores, test CAs and disposable certificates. Never include production private keys, passphrases or real certificate packages. Do not issue or revoke production certificates to demonstrate an issue. From 137bdd8440b9a9b2d3e0fca32a690e1b46c66784 Mon Sep 17 00:00:00 2001 From: Alessandro Digilio Date: Sat, 31 Oct 2026 11:36:58 +0100 Subject: [PATCH 2/2] =?UTF-8?q?docs(security):=20=F0=9F=93=9D=20clarify=20?= =?UTF-8?q?ownership=20of=20exposed=20credentials?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- SECURITY.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 2f3f81d..dec4ec7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,9 @@ Use [GitHub private vulnerability reporting](https://github.com/alsd4git/mtls-cl Do not disclose exploit details or sensitive data in public issues or pull requests. Include the affected commit or version, expected impact and minimal reproduction -steps. Use synthetic examples and redact screenshots and logs. If a credential -has been exposed, revoke or rotate it before sharing details. +steps. Use synthetic examples and redact screenshots and logs. If your own +credential was exposed, revoke or rotate it. Report credentials you do not control +promptly and privately; do not use or attempt to revoke them. ## Versions and maintenance