From f7b8eed255557ec70bb1c8f56c4c395f258253f2 Mon Sep 17 00:00:00 2001 From: clawdbot Date: Mon, 12 Oct 2026 22:07:57 +0000 Subject: [PATCH] docs(security): enable GitHub Security Advisories instructions (Fixes #3276) - Updated SECURITY.md with explicit instructions for reporting vulnerabilities via GitHub Security Advisories - Replaced 'when available' qualifier since Private Vulnerability Reporting is now enabled - Provided step-by-step guidance for security researchers to submit vulnerability reports --- SECURITY.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 282f6887..75f8a1c3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,10 +8,16 @@ unless a maintainer explicitly marks them as supported. ## Reporting a vulnerability -Please do **not** open a public issue for a suspected vulnerability. Use GitHub -private vulnerability reporting for `ultraworkers/claw-code` when available, or -contact a maintainer through the repository's published support channel with a -minimal, non-destructive reproduction. +Please do **not** open a public issue for a suspected vulnerability. Use [GitHub +Security Advisories](https://docs.github.com/en/code-security/security-advisories) +for `ultraworkers/claw-code`: + +1. Go to the **Security** tab of this repository +2. Click **"Report a vulnerability"** +3. Describe the issue with reproduction steps and impact + +Alternatively, contact a maintainer through the repository's published support +channel with a minimal, non-destructive reproduction. Include: