From a8b8a8ff690f211f4fd5a1bd421eae15440092ac Mon Sep 17 00:00:00 2001
From: "posthog[bot]" <206114724+posthog[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 08:10:15 +0000
Subject: [PATCH] docs(security): link the vulnerability disclosure program in
 SECURITY.md

Align the org SECURITY.md intake text with the wording live on posthog.com:
give both reporting paths and link the Bugcrowd vulnerability disclosure
program up front.

This org file is the default security policy GitHub serves on every PostHog
repository that has no copy of its own, so it is the intake instruction most
external researchers read. It named a disclosure program but never linked it,
which sent a reporter down the email-only path.

Generated-By: PostHog Desktop
Task-Id: 49f86155-fb68-4c88-8707-0116287e5d04
---
 SECURITY.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index b3c9468..c87823f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,6 +6,6 @@ We always recommend using the latest version of PostHog to ensure you get all se
 
 ## Reporting a Vulnerability
 
-Please report security vulnerabilities to security-reports@posthog.com.
+Security vulnerabilities and other security related findings can be reported through our [vulnerability disclosure program](https://bugcrowd.com/engagements/posthog-vdp-pro) or by email to [security-reports@posthog.com](mailto:security-reports@posthog.com).
 
-We currently operate a vulnerability disclosure program and reward valid, high quality reports with merch.
+We do not operate a bug bounty program, but we reward valid, actionable reports with merch.