From 1c30e256f5564bd30007dde38e16cdcbd409743b Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 15:59:18 +0000 Subject: [PATCH] Use private vulnerability reporting instead of public issues SECURITY.md told reporters to open a public GitHub issue, disclosing unpatched vulnerabilities. Direct them to GitHub private vulnerability reporting (Security Advisories) and explicitly forbid public issues. Refs java-helpers/simple-builders#170 Co-Authored-By: Andreas Igel --- SECURITY.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 0e49374b..bac69dbb 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,18 @@ If you discover a security vulnerability in Simple Builders, we appreciate your ### How to Report -Please report security issues by [opening a new issue](https://github.com/java-helpers/simple-builders/issues) on GitHub. +**Please do not report security vulnerabilities through public GitHub issues.** +Doing so discloses an unpatched issue to attackers before a fix is available. + +Instead, use GitHub's private vulnerability reporting: + +1. Open the repository's [**Security** tab](https://github.com/java-helpers/simple-builders/security). +2. Click **Report a vulnerability** to file a private + [GitHub Security Advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) + visible only to you and the maintainers. + +> Maintainers: enable *Private vulnerability reporting* under +> **Settings → Code security** so the button above is available to reporters. ### What to Include