From: Bjørn Erik Pedersen Date: Sat, 18 Apr 2026 21:05:27 +0000 (+0200) Subject: Adjust the SECURITY.md slightly X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=8ee19ff9a3471a7da9fdc07f5b5d8b48d839a2a6;p=brevno-suite%2Fhugo Adjust the SECURITY.md slightly --- diff --git a/SECURITY.md b/SECURITY.md index 6ac90f072..e6072ed84 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,7 +1,11 @@ ## Security Policy +### Before You Report + +Please read [Hugo's Security Model](https://gohugo.io/about/security/) first. If the issue reproduces in an upstream project, please report it there — we cannot triage or patch on their behalf. + ### Reporting a Vulnerability -Please report (suspected) security vulnerabilities to **[bjorn.erik.pedersen@gmail.com](mailto:bjorn.erik.pedersen@gmail.com)**. You will receive a response from us within 48 hours. If we can confirm the issue, we will release a patch as soon as possible depending on the complexity of the issue but historically within days. +If, after the above, you believe you have found a vulnerability in Hugo itself with a concrete, reproducible impact, report it privately to **[bjorn.erik.pedersen@gmail.com](mailto:bjorn.erik.pedersen@gmail.com)**. Include a minimal reproducer, the Hugo version, and the observed vs. expected behavior. -Also see [Hugo's Security Model](https://gohugo.io/about/security/). +You should receive an initial response within a few days. Confirmed issues are typically patched within days, depending on complexity.