From fd1e164421667f7de0b7afff49bea84793a5426a Mon Sep 17 00:00:00 2001 From: Julien Danjou Date: Sun, 18 Oct 2026 09:12:47 +0200 Subject: [PATCH] docs: add a security policy SECURITY.md tells reporters to use Mergify's HackerOne program rather than a public issue, gives security@mergify.com for other security questions and links the vulnerability disclosure policy on docs.mergify.com: the same places mergify.com/.well-known/security.txt points to. GitHub shows it in the repository's Security tab. AGENTS.md lists SECURITY.md with what this repository owns. Co-Authored-By: Claude Opus 5.5 Change-Id: I355718011c7149d534799873493f99a194074c0e --- AGENTS.md | 2 +- SECURITY.md | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 SECURITY.md diff --git a/AGENTS.md b/AGENTS.md index a1766973..90eee4a3 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -24,7 +24,7 @@ from `mergify-ci-bot`. Suggestions are welcome as issues. ## Owned here -- `.github/workflows/ci.yaml`, `.mergify.yml`, `renovate.json` and this `AGENTS.md`. +- `.github/workflows/ci.yaml`, `.mergify.yml`, `renovate.json`, `SECURITY.md` and this `AGENTS.md`. - The releases, published by `mergify-ci-bot`, never by hand. A release carrying the CLI binaries is Latest, which install.sh, `mergify self-update`, the Homebrew tap and the docs' CLI reference all follow. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..0e5575f1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,24 @@ +# Security Policy + +This policy covers the `mergify` CLI, its installer (`install.sh`), and the +agent skills and plugins published in this repository. + +## Reporting a vulnerability + +Please do not report security vulnerabilities through public GitHub issues, +discussions or pull requests. + +Report them privately through Mergify's bug bounty program on HackerOne: +. For other security questions, write to +. + +A useful report says which version you ran (`mergify --version`), how to +reproduce the issue and what an attacker gains from it. + +Mergify's vulnerability disclosure policy is published at +. + +## Supported versions + +Security fixes ship in a new release of the CLI. `mergify self-update`, +the installer and the Homebrew tap all install the latest release.