8000 docs(security): drop response-SLA, add no-bounty and safe-harbor by norrietaylor · Pull Request #854 · gominimal/minimal · GitHub
[go: up one dir, main page]
Skip to content

docs(security): drop response-SLA, add no-bounty and safe-harbor #854

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
norrietaylor merged 1 commit into from
Jul 20, 2026
Merged

docs(security): drop response-SLA, add no-bounty and safe-harbor #854

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 25 additions & 7 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# Security Policy

Thanks for helping keep Minimal and its users safe.

## Reporting a vulnerability

Please report vulnerabilities by email to **security@minimal.dev**. We
Expand All @@ -12,15 +14,21 @@ before a fix exists.

When reporting, include what you can of: the affected component and
version (`min --version` / `mip --version`), reproduction steps or a
proof of concept, and your assessment of the impact.
proof of concept, and your assessment of the impact. If you'd like to
encrypt your report, say so in your first email and we'll coordinate a
key exchange.

## No bug bounty

## Response expectations
Minimal does not operate a paid bug bounty program. We genuinely
appreciate good-faith reports and are glad to credit researchers in the
disclosure, but we do not offer monetary rewards.

We are a small team. We aim to acknowledge new reports within **5
business days** and to keep you informed as we triage, fix, and
disclose. Please give us a reasonable window to ship a fix before any
public disclosure; we will credit reporters in the advisory unless you
prefer otherwise.
We reserve the right to disregard low-effort, unsolicited "beg bounty"
reports — for example, automated scanner output, missing security
headers, or theoretical findings with no demonstrated impact on the
components in scope below. For background on why, see [Troy Hunt on beg
bounties](https://www.troyhunt.com/beg-bounties/).

## Supported versions

Expand Down Expand Up @@ -56,3 +64,13 @@ Out of scope:
the machine running minimal.
- Denial of service of your own local builds (e.g. a package
definition that consumes excessive resources on your machine).

## Safe harbor

We will not pursue or support legal action against researchers who:

- Make a good-faith effort to comply with this policy.
- Avoid privacy violations, destruction of data, and interruption or
degradation of others' use of minimal.
- Give us reasonable time to investigate and address a reported issue
before any public disclosure.
0