Skip to content

docs: consolidate security policy to canonical website URL #10559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MarkAtwood wants to merge 3 commits into
base: master
Choose a base branch
from
+18 −4
Open

docs: consolidate security policy to canonical website URL #10559

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6491193
docs: point security policy to canonical website URL
MarkAtwood May 29, 2026
fe70129
docs: use canonical secure@wolfssl.com for security reports
MarkAtwood Jun 2, 2026
66fe117
docs: keep in-repo security policy, fix contacts
MarkAtwood Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 18 additions & 4 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,26 @@

## Reporting a Vulnerability

**Use of the wolfSSL Vulnerability Report Template is mandatory.** All security reports must use [`SECURITY-REPORT-TEMPLATE.md`](../SECURITY-REPORT-TEMPLATE.md), with every required field completed. Reports that do not use the template, or that leave required fields incomplete, will not receive CVE consideration.
**Use of the wolfSSL Vulnerability Report Template is mandatory.** All security
reports must use [`SECURITY-REPORT-TEMPLATE.md`](../SECURITY-REPORT-TEMPLATE.md),
with every required field completed. Reports that do not use the template, or
that leave required fields incomplete, will not receive CVE consideration.

Submit the completed template to **support@wolfssl.com**.
Submit the completed template to **support@wolfssl.com**. You may also send it to
**secure@wolfssl.com** and encrypt it with our PGP key:

Non-template submissions may still be reviewed on the merits and, where appropriate, addressed as hardening fixes in a future release.
Fingerprint: A2A4 8E7B CB96 C5BE CB98 7314 EBC8 0E41 5CA2 9677
Key server: keys.openpgp.org

Non-template submissions may still be reviewed on the merits and, where
appropriate, addressed as hardening fixes in a future release.

**Please keep the vulnerability private** until a fix has been released.

For the full policy — severity rubric, coordinated-disclosure practice, and reporter credit — see [`SECURITY-POLICY.md`](../SECURITY-POLICY.md).
## Full Policy

For the full policy — severity rubric, scope, coordinated-disclosure practice,
and reporter credit — see [`SECURITY-POLICY.md`](../SECURITY-POLICY.md). The same
policy is also published at
<https://www.wolfssl.com/.well-known/vulnerability-disclosure-policy.txt> so that
other wolfSSL repositories can reference one canonical copy.
Loading