Repository navigation
Security policy #283
Description
Hi, I'm a member of the Drupal security team.
Drupal uses this library as a dependency and we want to ensure we have a way to report vulnerabilities upstream in the future if we need to.
It would be great if you could document a preferred method to report vulnerabilities privately.
I suggest adding a SECURITY.md file to the repository: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy
Activity
goetas commentedon Oct 24, 2026
Thanks for the suggestion. I've opened #284 adding a
SECURITY.mdthat points to GitHub's private vulnerability reporting. That feature still needs to be enabled in the repository settings (Settings → Code security) for the link to work.🤖 Generated with Claude Code