From f3d2e3238feae974347f2d94f867fc623ab2de75 Mon Sep 17 00:00:00 2001 From: Marko Vejnovic Date: Fri, 16 Oct 2026 13:17:24 -0700 Subject: [PATCH] docs: add SECURITY.md The only reporting route was an email line in CONTRIBUTING.md, which GitHub's Security tab does not surface. SECURITY.md names the advisory form and the email, and scopes reports to Hyper's own code; CONTRIBUTING points at it. --- CONTRIBUTING.md | 2 +- SECURITY.md | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 SECURITY.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7f4356c4..307f859e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -111,7 +111,7 @@ mix firecracker.gen Open a GitHub issue for bugs, with the version, your environment, and a minimal reproduction. For anything security-sensitive, **do not open a public issue** --- email the maintainer at instead. +-- follow [SECURITY.md](SECURITY.md) instead. You can also ask questions in the [community Discord](https://discord.gg/hm-dev). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..f3462f8f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,12 @@ +# Security + +Report vulnerabilities privately, through [GitHub's advisory +form](https://github.com/harmont-dev/hyper/security/advisories/new) or by email +to . Do not open a public issue. + +In scope is Hyper's own code: the setuid helper (`native/suidhelper/`), the +jail, network and device-mapper plumbing it drives, the guest agent, and the +gRPC API. + +Bugs in the host kernel, KVM or Firecracker belong upstream. We track their +impact on Hyper in public issues.