From c95f6840094092e86a68b0ea4126c3d14c129a3b Mon Sep 17 00:00:00 2001 From: James Ranson Date: Thu, 23 Jul 2026 09:33:20 -0600 Subject: [PATCH] add vulnerability reporting steps Signed-off-by: James Ranson --- CONTRIBUTING.md | 4 +++- SECURITY.MD | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 SECURITY.MD diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 62843ba..d6dcd2b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,8 +20,10 @@ Test all contributions locally before submitting Pull Requests by running `./run Relevant coding style guidelines are outlined in [CodingStyle.md](CodingStyle.md). This project uses [Ruff](https://docs.astral.sh/ruff/) for linting and formatting; run `uv run ruff format .` to format and `uv run ruff check .` to lint before submitting a Pull Request. Both run in CI, and the [pre-commit](https://pre-commit.com) hooks in `.pre-commit-config.yaml` apply them automatically on commit once installed with `uv run pre-commit install`. -## Reporting Feature Requests, Bugs and other Issues +## Reporting Feature Requests, Bugs, Vulnerabilities and other Issues If you find a bug in ThunderCloud, please file a detailed report as a GitHub Issue. We currently do not utilize an Issue template, but please be as thorough as possible in your report. There is no such thing as too much information. Likewise, if you have a Feature Request, please file a detailed Issue, explaining the feature's functionality and use cases. New Features should be beneficial to the broader community, so be sure to consider that before filing. + +If you have identified a potential security vulnerability in ThunderCloud, follow [these steps](SECURITY.MD) to report it privately. diff --git a/SECURITY.MD b/SECURITY.MD new file mode 100644 index 0000000..dd2a944 --- /dev/null +++ b/SECURITY.MD @@ -0,0 +1,3 @@ +# Security + +If you've found a vulnerability or a potential vulnerability in ThunderCloud, please let us know using the 'Report a vulnerability' button under the [Security and quality > Advisories](https://github.com/EarthSpark/thundercloud/security/advisories) section of the project.