From d09384f0c40ee7486f54d8e690dad9e4facccfbd Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Tue, 13 Oct 2026 15:58:42 -0300 Subject: [PATCH] docs: report security issues via GitHub draft advisories Point the README "Security issue" section and SECURITY.md at the GitHub private vulnerability reporting flow (draft security advisories) instead of the mailbox, keeping the email as a fallback for reporters without a GitHub account. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01U5Bdt1sc27UboMsnQVsmfs --- README.md | 10 +++++++--- SECURITY.md | 11 ++++++++++- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 7bb6a0aa95..3cff2ec108 100644 --- a/README.md +++ b/README.md @@ -446,9 +446,13 @@ is one. ### Security issue -Please do not make public any security issue. Contact us at: -modsecurity@owasp.org reporting the issue. Once the problem is fixed your -credit will be given. +Please do not report security issues publicly. Instead, open a +[draft security advisory](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/new) +on GitHub so the report stays private while the maintainers triage it and +prepare a fix. The advisory is published together with the fixed release, and +reporters are credited in it. + +If you cannot use GitHub, email modsecurity@owasp.org instead. ## Feature request diff --git a/SECURITY.md b/SECURITY.md index fafb57326c..17707dfbac 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,4 +6,13 @@ The latest versions of both v2.9.x and v3.0.x are supported. ## Reporting a Vulnerability -For information on how to report a security issue, please see https://github.com/owasp-modsecurity/ModSecurity#security-issue +Please do not report security issues publicly (no GitHub issues, pull +requests or mailing lists). + +Report them privately by opening a +[draft security advisory](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/new) +on GitHub. The maintainers triage the report there, coordinate a fix with you +and publish the advisory together with the fixed release. Reporters are +credited in the published advisory. + +If you cannot use GitHub, email modsecurity@owasp.org instead.