From 507ec8f0c83ee4e54398964427ae234e55226163 Mon Sep 17 00:00:00 2001 From: Winni Neessen Date: Thu, 8 Oct 2026 13:54:08 +0200 Subject: [PATCH 1/2] docs: add organization-wide SECURITY.md file --- SECURITY.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..f12bcf2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,29 @@ +# Security Policy + +## Reporting a Vulnerability + +If you believe you have found a security vulnerability, please report it +privately using one of the following channels: + +- GitHub's private vulnerability reporting: open the **Security and quality** tab + of the affected repository, then click **Report a vulnerability**. +- Email: [security@hetzner.com](mailto:security@hetzner.com) + +Please do not report security vulnerabilities through public GitHub issues or discussions. + +We welcome all reports. If you are unsure whether an issue qualifies as +a security vulnerability, please report it anyway. We will review the +details and work with you to determine whether action is needed. + +When reporting, please include as much of the following as possible: + +- A description of the issue and its potential impact +- Steps to reproduce, or a proof of concept +- Affected versions, components, or configurations + +## Encrypted Communication + +We encourage you to encrypt reports that contain sensitive information. You can +send OpenPGP-encrypted email to +[security@hetzner.com](mailto:security@hetzner.com) using our public key, +available at [https://hetzner.com/pgp-key.txt](https://hetzner.com/pgp-key.txt). From e3cbe1b5eef519eb2765549d22d480edfc068538 Mon Sep 17 00:00:00 2001 From: Winni Neessen Date: Thu, 8 Oct 2026 13:56:56 +0200 Subject: [PATCH 2/2] docs: fix trailing whitespaces --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f12bcf2..11c4620 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## Reporting a Vulnerability -If you believe you have found a security vulnerability, please report it +If you believe you have found a security vulnerability, please report it privately using one of the following channels: - GitHub's private vulnerability reporting: open the **Security and quality** tab @@ -25,5 +25,5 @@ When reporting, please include as much of the following as possible: We encourage you to encrypt reports that contain sensitive information. You can send OpenPGP-encrypted email to -[security@hetzner.com](mailto:security@hetzner.com) using our public key, +[security@hetzner.com](mailto:security@hetzner.com) using our public key, available at [https://hetzner.com/pgp-key.txt](https://hetzner.com/pgp-key.txt).