From 8ee19ff9a3471a7da9fdc07f5b5d8b48d839a2a6 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Bj=C3=B8rn=20Erik=20Pedersen?= Date: Sat, 18 Apr 2026 23:05:27 +0200 Subject: [PATCH] Adjust the SECURITY.md slightly --- SECURITY.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 6ac90f072..e6072ed84 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,7 +1,11 @@ ## Security Policy +### Before You Report + +Please read [Hugo's Security Model](https://gohugo.io/about/security/) first. If the issue reproduces in an upstream project, please report it there — we cannot triage or patch on their behalf. + ### Reporting a Vulnerability -Please report (suspected) security vulnerabilities to **[bjorn.erik.pedersen@gmail.com](mailto:bjorn.erik.pedersen@gmail.com)**. You will receive a response from us within 48 hours. If we can confirm the issue, we will release a patch as soon as possible depending on the complexity of the issue but historically within days. +If, after the above, you believe you have found a vulnerability in Hugo itself with a concrete, reproducible impact, report it privately to **[bjorn.erik.pedersen@gmail.com](mailto:bjorn.erik.pedersen@gmail.com)**. Include a minimal reproducer, the Hugo version, and the observed vs. expected behavior. -Also see [Hugo's Security Model](https://gohugo.io/about/security/). +You should receive an initial response within a few days. Confirmed issues are typically patched within days, depending on complexity. -- 2.39.5