From 24e8f40672dd2122b815b51e1be025b143554d11 Mon Sep 17 00:00:00 2001 From: Gabriel Taveira Date: Tue, 28 Jul 2026 14:24:33 -0300 Subject: [PATCH] docs: add a security policy There was no SECURITY.md here, so a vulnerability report had nowhere to go except a public issue. Private vulnerability reporting is enabled on the repo now and the file points at the advisory form. No version table and no response-time promise: there are no backport branches to describe, and a stale support matrix is exactly what went wrong with safe-jsx's copy. Repo file only. The files array is untouched, so no published tarball changes. --- SECURITY.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..75813ad --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,12 @@ +# Security Policy + +## Reporting a Vulnerability + +Report it privately through GitHub's advisory form: +https://github.com/GSTJ/react-native-code-push-plugin/security/advisories/new + +Don't open a public issue for a security problem. + +## Supported Versions + +Fixes ship in a new release off the latest published version. Stay on it; there are no backport branches.