diff --git a/.changeset/plenty-pots-lose.md b/.changeset/plenty-pots-lose.md new file mode 100644 index 00000000000..a845151cc84 --- /dev/null +++ b/.changeset/plenty-pots-lose.md @@ -0,0 +1,2 @@ +--- +--- diff --git a/docs/SECURITY.md b/docs/SECURITY.md index eb1a76f8257..f15fe02a8d1 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -1,19 +1,9 @@ # Security Policy -We take the security of our systems seriously, and we value the security community. The disclosure of security vulnerabilities helps us ensure the security and privacy of our users. +We take the security of our systems seriously, and we value the security community. The disclosure of security vulnerabilities helps us ensure the security and privacy of our users. Learn more about security at Clerk at [clerk.com/security](https://clerk.com/security). ## Reporting a Vulnerability **Please do not report security vulnerabilities through public GitHub issues.** -If you believe you’ve found a security vulnerability in one of our products or platforms, please send it to us by emailing [security@clerk.dev](mailto:security@clerk.dev). Please include the following details with your report: - -1. Description of the location and potential impact of the vulnerability; and - -2. A detailed description of the steps required to reproduce the vulnerability (POC scripts, screenshots, and compressed screen captures are all helpful to us). - -We will evaluate the vulnerability and, if necessary, release a fix or mitigating steps to address it. We will contact you to let you know the outcome, and will credit you in the report. - -Please **do not disclose the vulnerability publicly** until a fix is released. - -Once we have either a) published a fix, or b) declined to address the vulnerability for whatever reason, you are free to publicly disclose it. +If you believe you’ve found a security vulnerability in one of our products or platforms, please report it following our [vulnerability disclosure policy](https://clerk.com/docs/guides/how-clerk-works/security/vulnerability-disclosure-policy), which covers scope, how to submit a report, and what to expect from us.