From 2027d6d379052ae4ce46084fd04c96e6ece9d1d4 Mon Sep 17 00:00:00 2001 From: sup2ak Date: Sat, 25 Apr 2026 13:22:56 +0200 Subject: [PATCH] chore: add SECURITY.md with vulnerability disclosure policy Provides a dedicated security policy for socket.dev policy checks and GitHub's security tab. Directs reporters to GitHub's private vulnerability reporting rather than a public issue. --- SECURITY.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5a4437c --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,29 @@ +# Security Policy + +## Supported versions + +Only the latest published version of matchigo receives security fixes. + +| Version | Supported | +| ------- | --------- | +| latest | ✅ | +| older | ❌ | + +## Reporting a vulnerability + +**Do not open a public issue for security reports.** + +Use GitHub's private vulnerability reporting instead: +**[Report a vulnerability](https://github.com/SUP2Ak/matchigo/security/advisories/new)** + +Include: + +- A description of the vulnerability and its potential impact. +- Steps to reproduce or a minimal proof of concept. +- The matchigo version, runtime (Node/Bun/Deno) and TypeScript version. + +I will acknowledge your report within **72 hours** and aim to release a fix within **14 days** depending on severity. I will credit you in the release notes unless you prefer to remain anonymous. + +## Scope + +matchigo is a zero-dependency TypeScript pattern-matching library with no network access, no file system access, and no external calls. The attack surface is limited to pattern evaluation logic and type inference. Reports outside this scope (e.g. your bundler, your runtime) should be directed to the relevant upstream project.