From 6d6c83be0106e0194bcbb334e2efa899053c74ac Mon Sep 17 00:00:00 2001 From: Bellman <54757707+Yeachan-Heo@users.noreply.github.com> Date: Tue, 13 Oct 2026 07:15:26 +0900 Subject: [PATCH] docs(security): enable GitHub Security Advisories instructions (Fixes #3276) (#3311) - Updated SECURITY.md with explicit instructions for reporting vulnerabilities via GitHub Security Advisories - Replaced 'when available' qualifier since Private Vulnerability Reporting is now enabled - Provided step-by-step guidance for security researchers to submit vulnerability reports Co-authored-by: clawdbot --- SECURITY.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 282f6887..75f8a1c3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,10 +8,16 @@ unless a maintainer explicitly marks them as supported. ## Reporting a vulnerability -Please do **not** open a public issue for a suspected vulnerability. Use GitHub -private vulnerability reporting for `ultraworkers/claw-code` when available, or -contact a maintainer through the repository's published support channel with a -minimal, non-destructive reproduction. +Please do **not** open a public issue for a suspected vulnerability. Use [GitHub +Security Advisories](https://docs.github.com/en/code-security/security-advisories) +for `ultraworkers/claw-code`: + +1. Go to the **Security** tab of this repository +2. Click **"Report a vulnerability"** +3. Describe the issue with reproduction steps and impact + +Alternatively, contact a maintainer through the repository's published support +channel with a minimal, non-destructive reproduction. Include: