73d65ed701
Clarify that a dependency having a CVE does not mean gh has a vulnerability. We use govulncheck for reachability analysis and ask reporters to demonstrate impact before we act on dependency CVE reports. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| CODE-OF-CONDUCT.md | ||
| CODEOWNERS | ||
| CONTRIBUTING.md | ||
| dependabot.yml | ||
| licenses.tmpl | ||
| PULL_REQUEST_TEMPLATE.md | ||
| SECURITY.md | ||