From d48abe3fe47152fa98cdc4d939f36b3b1681bdb7 Mon Sep 17 00:00:00 2001 From: Fedor Chelnokov Date: Tue, 8 Sep 2026 13:53:35 +0300 Subject: [PATCH] Add organization-wide SECURITY.md --- SECURITY.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..2c411f5 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,25 @@ +# Security Policy + +This policy applies to every public repository of the MeshInspector organization, including [MeshLib](https://github.com/MeshInspector/MeshLib) and our [OpenCTM](https://github.com/MeshInspector/OpenCTM) fork. + +## Reporting a vulnerability + +Please do not report security issues through public GitHub issues, discussions or pull requests. Use one of these private channels: + +- **GitHub private vulnerability reporting**: open the *Security* tab of the affected repository and choose *Report a vulnerability*. +- **Email**: support@meshinspector.com with `[Security]` at the start of the subject. + +Include what you can of: the affected repository and commit or release, the file and function, a proof-of-concept input or program, the observed behaviour (sanitizer output, crash, stack trace), and your assessment of the impact. + +## What to expect + +- We acknowledge reports within three business days. +- We confirm the issue, tell you our planned fix and timeline, and keep you informed of progress. +- We fix the issue on the default branch and ship it in the next MeshLib release. If a fix needs time, we agree a disclosure date with you; otherwise the fix is public as soon as it is merged. +- We credit reporters by name in the fix and release notes unless you ask us not to. + +We do not run a bug bounty programme. + +## Supported versions + +Security fixes are made on the default branch and delivered in the next release. Older releases are not patched.