4 commits

Author	SHA1	Message	Date
Kynan Ware	73d65ed701	Document dependency CVE policy in SECURITY.md ... Clarify that a dependency having a CVE does not mean gh has a vulnerability. We use govulncheck for reachability analysis and ask reporters to demonstrate impact before we act on dependency CVE reports. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-04-08 11:28:30 -06:00
Kynan Ware	023a44904a	Update SECURITY.md	2024-10-01 12:02:54 -06:00
Mislav Marohnić	30ad3f0fd1	Fix SECURITY.md	2022-11-09 20:07:56 +01:00
Lee Reilly	6bc6ca6c8e	Add first draft of SECURITY.md	2019-12-19 12:33:45 -08:00