From 25d9cf4524556a82aab75c1d5caf3d2f033ce4c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=B4=8B=E5=AD=90?= <purocean@outlook.com>
Date: Wed, 7 Oct 2026 11:29:55 +0800
Subject: [PATCH] docs: add bilingual security reporting policy

---
 SECURITY.md | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..9ec4646a
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,35 @@
+# Security Policy / 安全政策
+
+## Reporting a vulnerability
+
+Please report suspected security vulnerabilities privately to [yank-note@hotmail.com](mailto:yank-note@hotmail.com). Please coordinate disclosure before including vulnerability details in a public issue or pull request.
+
+Please include:
+
+- A description of the issue, its impact, and any conditions required to exploit it.
+- The affected Yank Note version, operating system, and relevant configuration or extensions.
+- Minimal, safe steps to reproduce, with a proof of concept or redacted logs if helpful.
+- Any proposed mitigation or fix, and your preferred contact and credit details.
+
+Test only on systems and data you own or have permission to use. Avoid destructive testing, disruption, or accessing other people's data. Use synthetic data and remove passwords, tokens, personal information, and other secrets from reports.
+
+## Coordinated disclosure
+
+Please give the maintainer a reasonable opportunity to investigate and prepare a fix or mitigation. Share any planned disclosure date and discuss timing together. Where possible, avoid publishing actionable exploit details or proof-of-concept code while the issue remains unresolved. Any public credit should be agreed with the reporter.
+
+## 报告安全漏洞
+
+如发现疑似安全漏洞，请先通过 [yank-note@hotmail.com](mailto:yank-note@hotmail.com) 私下报告。请先协调披露，再在公开 Issue 或 Pull Request 中分享漏洞细节。
+
+请尽量提供：
+
+- 问题描述、影响及利用所需的前提条件。
+- 受影响的 Yank Note 版本、操作系统，以及相关配置或扩展。
+- 最小且安全的复现步骤，必要时附上验证代码或已脱敏的日志。
+- 可行的缓解或修复建议，以及希望使用的联系方式和署名方式。
+
+请仅在自己拥有或获准使用的系统和数据上测试，避免破坏性操作、影响服务或访问他人数据。请使用模拟数据，并移除报告中的密码、令牌、个人信息及其他敏感内容。
+
+## 协调披露
+
+请给维护者合理的时间调查问题并准备修复或缓解措施。如有计划公开披露的日期，请提前沟通并共同讨论时间安排。在问题尚未解决时，请尽量避免公开可直接用于攻击的细节或验证代码。公开致谢及署名应与报告者协商一致。