From 76213bd0c5098e3009e4cb4dcc7f8b0642a2259f Mon Sep 17 00:00:00 2001 From: Zeev Manilovich Date: Tue, 13 Oct 2026 04:26:48 +0300 Subject: [PATCH] Add a security policy Points reporters to GitHub's private vulnerability reporting and says what is in scope for an examples repository. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01ARnk1jhjwpyA9h4PmTsabQ --- SECURITY.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..213b9fc --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,15 @@ +# Security policy + +## Reporting a vulnerability + +Report vulnerabilities in this repository privately, through GitHub: open the repository's +**Security** tab and choose **Report a vulnerability**. Please don't open a public issue or pull +request for a security problem. + +Include the example's folder, what an attacker could do, and the steps to reproduce it. + +## Scope + +This repository holds example applications that show how to use Permit.io. They are built to run +locally against a Permit environment made for them, not as production services. Reports about the +examples' own code, their dependencies and their CI workflows are in scope.