From 776d9fef4ae1835d1e304124b440f69c94be2c01 Mon Sep 17 00:00:00 2001 From: bcsik Date: Tue, 13 Oct 2026 12:07:04 +0100 Subject: [PATCH 1/2] docs: add organisation-wide security policy Repositories without their own SECURITY.md fall back to this one, which also satisfies OpenSSF Scorecard's Security-Policy check. Co-Authored-By: Claude Opus 5.5 --- SECURITY.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..c8fab39 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,25 @@ +# Security Policy + +This policy covers every Budavári Schönherz Stúdió repository that has no `SECURITY.md` of its own. + +## Supported versions + +Only the latest release, deployed from the default branch, gets security fixes. + +## Reporting a vulnerability + +**Do not open a public issue, discussion or pull request for a security vulnerability.** + +Report it privately through GitHub's private vulnerability reporting: + +1. Open the affected repository's **Security** tab. +2. Choose **Report a vulnerability**. The direct link is + `https://github.com/BSStudio//security/advisories/new`. + +Please include the affected version or commit, the steps to reproduce it, and its impact. + +## Disclosure + +We acknowledge reports within 7 days and keep you updated while we work on a fix. Once a fix is +released we publish a GitHub security advisory and credit you, unless you ask us not to. Please give +us a reasonable amount of time to fix the issue before you disclose it publicly. From 543c204d953a82bf44fcbfbda304036b46c47c30 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliv=C3=A9r=20Kecskem=C3=A9ty?= Date: Tue, 13 Oct 2026 20:06:10 +0200 Subject: [PATCH 2/2] Unwrap hard-wrapped paragraphs --- SECURITY.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index c8fab39..f021441 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -13,13 +13,10 @@ Only the latest release, deployed from the default branch, gets security fixes. Report it privately through GitHub's private vulnerability reporting: 1. Open the affected repository's **Security** tab. -2. Choose **Report a vulnerability**. The direct link is - `https://github.com/BSStudio//security/advisories/new`. +2. Choose **Report a vulnerability**. The direct link is `https://github.com/BSStudio//security/advisories/new`. Please include the affected version or commit, the steps to reproduce it, and its impact. ## Disclosure -We acknowledge reports within 7 days and keep you updated while we work on a fix. Once a fix is -released we publish a GitHub security advisory and credit you, unless you ask us not to. Please give -us a reasonable amount of time to fix the issue before you disclose it publicly. +We acknowledge reports within 7 days and keep you updated while we work on a fix. Once a fix is released we publish a GitHub security advisory and credit you, unless you ask us not to. Please give us a reasonable amount of time to fix the issue before you disclose it publicly.