From 52fb9bdd01f401d5810a103e65f344c3d1cfc3c9 Mon Sep 17 00:00:00 2001 From: Priyanshubhartistm Date: Mon, 19 Oct 2026 00:50:43 +0530 Subject: [PATCH] docs: support nostream 3.5+ only and name a private reporting route Signed-off-by: Priyanshubhartistm --- .changeset/security-policy.md | 2 ++ SECURITY.md | 27 +++++++++++++++++---------- 2 files changed, 19 insertions(+), 10 deletions(-) create mode 100644 .changeset/security-policy.md diff --git a/.changeset/security-policy.md b/.changeset/security-policy.md new file mode 100644 index 000000000..a845151cc --- /dev/null +++ b/.changeset/security-policy.md @@ -0,0 +1,2 @@ +--- +--- diff --git a/SECURITY.md b/SECURITY.md index fd72ba0e9..51201c86b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,18 +2,25 @@ ## Supported Versions -Use this section to tell people about which versions of your project are -currently being supported with security updates. +Security fixes land on **nostream 3.5 and newer** only. The current release line is 3.6.x (3.6.1 at the time of writing). -| Version | Supported | -| --------- | ------------------ | -| > 1.11.x | :white_check_mark: | -| < 1.9.0 | :x: | +| Version | Supported | +| --------------- | ------------------ | +| 3.5.x and newer | :white_check_mark: | +| 3.0.x – 3.4.x | :x: | +| 2.x | :x: | +| 1.x | :x: | + +Unsupported lines receive no advisories, backports or patches. If you run one of them, upgrade to a supported version before reporting. + +The Rust rewrite (`rewrite/main`) does not ship a release yet. It is covered by this policy as it ships. ## Reporting a Vulnerability -Use this section to tell people how to report a vulnerability. +Please do not open a public issue for a security problem. Report it privately through GitHub's private vulnerability reporting: + + + +Include the affected version, how your deployment is configured, and steps to reproduce. -Tell them where to go, how often they can expect to get an update on a -reported vulnerability, what to expect if the vulnerability is accepted or -declined, etc. +You can expect a first response within 7 days. After that, we will keep you updated on the progress of the report. If the report is accepted, we will work on a fix and publish a security advisory once a patched release is available. If it is declined, we will explain why.