From 756d41575504563dca667cb053988c55750a7918 Mon Sep 17 00:00:00 2001 From: Arnaud Lacurie Date: Wed, 29 Jul 2026 12:49:35 +0100 Subject: [PATCH] Use GitHub private vulnerability reporting for security issues Replace the fdb-oss-security@group.apple.com mailto instructions in SECURITY.md and CONTRIBUTING.md with a link to GitHub's private vulnerability reporting form, and point CONTRIBUTING.md at SECURITY.md so the reporting process is documented in one place. --- CONTRIBUTING.md | 2 +- SECURITY.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f142b3dfae..dc660d484c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -45,7 +45,7 @@ We use a pre-commit pipeline with black and flake8 to enforce python best coding Please refer to the section below on [using GitHub issues and the community forums](#using-github-issues-and-community-forums) for more info. #### Security issues -To report a security issue, please **DO NOT** start by filing a public issue or posting to the forums; instead send a private email to [fdb-oss-security@group.apple.com](mailto:fdb-oss-security@group.apple.com). +To report a security issue, please **DO NOT** start by filing a public issue or posting to the forums. Instead, use GitHub's private vulnerability reporting to [report a vulnerability](https://github.com/apple/foundationdb/security/advisories/new). Only the maintainers can see the report, and we will follow up with you there. See [SECURITY.md](SECURITY.md) for more. ## Project Communication ### Community Forums diff --git a/SECURITY.md b/SECURITY.md index bb7f0832cd..d214a3ac68 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,3 @@ # Security issues -To report a security issue, please **DO NOT** start by filing a public issue or posting to the forums; instead send a private email to [fdb-oss-security@group.apple.com](mailto:fdb-oss-security@group.apple.com). +To report a security issue, please **DO NOT** start by filing a public issue or posting to the forums. Instead, use GitHub's private vulnerability reporting to [report a vulnerability](https://github.com/apple/foundationdb/security/advisories/new). Only the maintainers can see the report, and we will follow up with you there.