From 8ac886f74ba381d94b93bbe7092b0fb86acfa4ba Mon Sep 17 00:00:00 2001 From: aryansk <70511529+aryansk@users.noreply.github.com> Date: Tue, 25 Aug 2026 13:37:28 +0530 Subject: [PATCH] Docs: add SECURITY.rst Adds SECURITY.rst documenting the security policy for Sphinx: report via GitHub Security Advisories (preferred) or email as per CONTRIBUTING.rst, supported versions, and disclosure policy. Fixes sphinx-doc/sphinx#13063 Co-authored-by: Muse Spark Co-authored-by: Aryan Singh K <70511529+aryansk@users.noreply.github.com> AI disclosure: Muse Spark assisted in drafting the policy; changes reviewed and tested manually. --- SECURITY.rst | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 SECURITY.rst diff --git a/SECURITY.rst b/SECURITY.rst new file mode 100644 index 00000000000..53066b744a8 --- /dev/null +++ b/SECURITY.rst @@ -0,0 +1,23 @@ +Security +======== + +Reporting a Vulnerability +------------------------- + +Please do not report security vulnerabilities via public GitHub issues. + +Instead, please report them via `GitHub Security Advisories `_ (preferred) or by emailing the maintainers as described in :doc:`CONTRIBUTING`. + +We will acknowledge receipt within two working days and will work with you to understand the issue, provide a fix, and coordinate disclosure. + +Supported Versions +------------------ + +Security fixes are provided for the latest released version of Sphinx and, when feasible, for the previous minor version. + +Disclosure Policy +----------------- + +When a vulnerability is fixed, it will be announced in the `CHANGES` and via a GitHub Security Advisory. Please allow us time to prepare a fix and advisory before public disclosure. + +For more information, see `GitHub's documentation on reporting security vulnerabilities `_.