From 7d33816f6e64bbb5cebab45c74500d9c937725e1 Mon Sep 17 00:00:00 2001 From: Tim Carr Date: Tue, 7 Jul 2026 17:12:33 +0800 Subject: [PATCH 1/3] Add Security Disclosure Policy --- SECURITY.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..085dc0c --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,32 @@ +# Security Policy + +This security policy applies to public projects under the [Kit organization](https://github.com/kit) on GitHub. + +## Reporting a Vulnerability + +If you discover a security vulnerability, please report via any of the below: + +- [BugCrowd](https://docs.bugcrowd.com/researchers/reporting-managing-submissions/reporting-a-bug/#creating-a-vulnerability-report) +- [PatchStack]() +- [GitHub](https://github.com/Kit/convertkit-wordpress-libraries/security/advisories) +- [Email](mailto:security@kit.com) + +Please do **not** report security issues publicly via GitHub issues or discussions. Security reports sent via the above channels be acknowledged within 48 hours. + +## Security Disclosure Process + +When reporting a security vulnerability, please include: + +1. **Description** - A clear description of the vulnerability +2. **Impact** - What kind of vulnerability it is and who it impacts +3. **Reproduction** - Detailed steps to reproduce the issue +4. **Proof of Concept** - If applicable, include proof-of-concept code +5. **Suggested Fix** - If you have ideas for how to fix the issue + +## Security Response Timeline + +- **Initial Response**: Within 48 hours of receiving the report +- **Investigation**: We will investigate and validate the reported vulnerability +- **Fix Development**: Development of a patch or mitigation strategy +- **Release**: Coordinated disclosure and release of security update +- **Public Disclosure**: After users have had time to upgrade \ No newline at end of file From 7f212ee16c82ceea4554df4500b472e678f8a4c7 Mon Sep 17 00:00:00 2001 From: Tim Carr Date: Tue, 21 Jul 2026 15:13:14 +0800 Subject: [PATCH 2/3] Update security policy --- SECURITY.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 085dc0c..8e2f28d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,7 @@ This security policy applies to public projects under the [Kit organization](htt If you discover a security vulnerability, please report via any of the below: -- [BugCrowd](https://docs.bugcrowd.com/researchers/reporting-managing-submissions/reporting-a-bug/#creating-a-vulnerability-report) -- [PatchStack]() +- [Kit](https://kit.com/report-vulnerability) - [GitHub](https://github.com/Kit/convertkit-wordpress-libraries/security/advisories) - [Email](mailto:security@kit.com) From 525ce68fdafd0ca2edb0f9a7bd6777a8474de3b6 Mon Sep 17 00:00:00 2001 From: Tim Carr Date: Fri, 24 Jul 2026 10:34:40 +0800 Subject: [PATCH 3/3] Update security policy --- SECURITY.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 8e2f28d..0e4092e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,7 +10,7 @@ If you discover a security vulnerability, please report via any of the below: - [GitHub](https://github.com/Kit/convertkit-wordpress-libraries/security/advisories) - [Email](mailto:security@kit.com) -Please do **not** report security issues publicly via GitHub issues or discussions. Security reports sent via the above channels be acknowledged within 48 hours. +Please do **not** report security issues publicly via GitHub issues or discussions. Security reports sent via the above channels will be acknowledged within 48 hours. ## Security Disclosure Process @@ -24,8 +24,8 @@ When reporting a security vulnerability, please include: ## Security Response Timeline -- **Initial Response**: Within 48 hours of receiving the report -- **Investigation**: We will investigate and validate the reported vulnerability +- **Initial Response**: Acknowledgement within 48 hours of receiving the report +- **Investigation**: Investigation and validation of the reported vulnerability - **Fix Development**: Development of a patch or mitigation strategy - **Release**: Coordinated disclosure and release of security update -- **Public Disclosure**: After users have had time to upgrade \ No newline at end of file +- **Public Disclosure**: Public announcement after users have had time to upgrade \ No newline at end of file