From d5731841d67bf128d2ef60ab3db94b0054445259 Mon Sep 17 00:00:00 2001 From: Michael Taufen Date: Fri, 24 Jul 2026 17:20:07 -0700 Subject: [PATCH] fixup to make triage policy consistent with summary --- .github/SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 4569c545e..64934e59e 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -116,8 +116,8 @@ What to expect at this stage: - Fixes are best effort and land on `main`. All valid reports will be patched by GA. - There is no embargo process and no pre-disclosure notification to - downstream users or vendors. Details stay in the private advisory until a - fix is merged. + downstream users or vendors. Though we do wait to publish advisories until + fixes have been merged, some details may appear in PRs prior to publishing. We ask reporters to keep vulnerability details private until an advisory is published; we prefer to disclose as soon as a fix is available.