mirror of
https://github.com/doocs/md.git
synced 2026-08-30 17:35:08 +08:00
Libin YANG
8a20da94a5
Bump direct and transitive deps to latest versions while keeping Prettier pinned at 2.8.8. Force shell-quote to 1.8.4 to resolve CVE-2026-9277 and add SECURITY.md. Co-authored-by: Cursor <cursoragent@cursor.com>
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 2.x | :white_check_mark: |
|
|
| < 2.0 | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in doocs/md, please report it responsibly:
|
|
|
|
1. **Do not** open a public GitHub issue for security-sensitive reports.
|
|
2. Email the maintainers at [security@doocs.org](mailto:security@doocs.org), or use [GitHub Private Vulnerability Reporting](https://github.com/doocs/md/security/advisories/new) if available.
|
|
3. Include a clear description, steps to reproduce, and impact assessment when possible.
|
|
|
|
We aim to acknowledge reports within **3 business days** and will work with you on a fix and coordinated disclosure timeline.
|
|
|
|
## Security Updates
|
|
|
|
- Dependency updates and security fixes are tracked via [Dependabot alerts](https://github.com/doocs/md/security/dependabot).
|
|
- Published advisories appear on the [Security tab](https://github.com/doocs/md/security/advisories).
|
|
|
|
Thank you for helping keep doocs/md and its users safe.
|