Update the security policy to prevent some back and forth with the co…

…mmunity (#437) * Update the security policy to prevent some back and forth with the community * Adding a mention about third-party libraries Signed-off-by: Bruno Oliveira da Silva <[email protected]>
keycloak · Dec 14, 2023 · 07bb0e8 · 07bb0e8
1 parent a5d52c7
commit 07bb0e8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/pages/security.ftl b/pages/security.ftl
@@ -11,7 +11,7 @@
 
     <p>It is important that suspected vulnerabilities are disclosed in a responsible way, and are not publicly disclosed until after they have been analysed and a fix is available.</p>
 
-    <p>To report a security vulnerability, send an email to <a href="mailto:[email protected]">[email protected]</a>.</p>
+    <p>To report a security vulnerability in the Keycloak codebase, send an email to <a href="mailto:[email protected]">[email protected]</a>. Please include the version affected, provide detailed instructions on how to reproduce the issue, and include your contact information for acknowledgements. If you are reporting known CVEs related to third-party libraries used in Keycloak, please <a href="https://github.com/keycloak/keycloak/issues/new/choose">create a new GitHub issue</a>.</p>
 
     <p>If you would like to work with us on a fix for the security vulnerability, please include your GitHub username in the above email, and we will provide you access to a temporary private fork where we can collaborate on a fix without it being disclosed publicly.</p>