From 72279f5749310eb3a684f3fbc5cf54bbea3b845d Mon Sep 17 00:00:00 2001 From: Doberjohn Date: Tue, 3 Nov 2026 12:18:54 +0200 Subject: [PATCH] docs: add a security policy Point reporters to GitHub's private vulnerability reporting and list the versions that get security fixes. --- SECURITY.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..8de0797485 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,17 @@ +# Security policy + +## Supported versions + +| Version | Security fixes | +| --------------------------------------------------------- | -------------- | +| 6.x (`main`, published under the `alpha` tag until 6.0.0) | Yes | +| The latest 5.x release | Yes | +| Older 5.x releases and earlier majors | No | + +## Reporting a vulnerability + +Please don't report security problems in public issues, pull requests or discussions. + +Report them privately through GitHub instead: on the repository's Security tab, click "Report a vulnerability", or go straight to https://github.com/callstack/react-native-paper/security/advisories/new. Include what is affected (the version and the component or API), how to reproduce it, and what an attacker could do with it. + +The maintainers will reply in the advisory, work on a fix there with you, and credit you when it is published, unless you'd rather not be named.