29b344a7102a2fe427d5ea6bcde4044898be1112

Message

chore: update security docs and link to huntr.dev

Diff

This diff is truncated to protect this page.

 1diff --git a/README.md b/README.md
 2index 5712c170193bda1145ac9d1b83e8dfd33e048ffa..310283e92678640ac85505471e761c27148abf2d 100644
 3--- a/README.md
 4+++ b/README.md
 5@@ -16,6 +16,7 @@ To learn more, visit [ohmyz.sh](https://ohmyz.sh), follow [@ohmyzsh](https://twi
 6 [![Follow @ohmyzsh](https://img.shields.io/twitter/follow/ohmyzsh?label=Follow+@ohmyzsh&style=flat)](https://twitter.com/intent/follow?screen_name=ohmyzsh)
 7 [![Discord server](https://img.shields.io/discord/642496866407284746)](https://discord.gg/ohmyzsh)
 8 [![Gitpod ready](https://img.shields.io/badge/Gitpod-ready-blue?logo=gitpod)](https://gitpod.io/#https://github.com/ohmyzsh/ohmyzsh)
 9+[![huntr.dev](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev/bounties/disclose/?utm_campaign=ohmyzsh%2Fohmyzsh&utm_medium=social&utm_source=github&target=https%3A%2F%2Fgithub.com%2Fohmyzsh%2Fohmyzsh)
10 
11 ## Getting Started
12 
13diff --git a/SECURITY.md b/SECURITY.md
14index cda53379f78c975dddd21f4b8c10b964a2053be6..7e5c8eed079055712b7d731340781296262dcb02 100644
15--- a/SECURITY.md
16+++ b/SECURITY.md
17@@ -3,7 +3,8 @@
18 ## Supported Versions
19 
20 At the moment Oh My Zsh only considers the very latest commit to be supported.
21-We combine that with our fast response to incidents, so risk is minimized.
22+We combine that with our fast response to incidents and the automated updates
23+to minimize the time between vulnerability publication and patch release.
24 
25 | Version        | Supported          |
26 |:-------------- |:------------------ |
27@@ -14,9 +15,10 @@ In the near future we will introduce versioning, so expect this section to chang
28 
29 ## Reporting a Vulnerability
30 
31-If you find a vulnerability, email all the maintainers directly at:
32+**Do not submit an issue or pull request**: this might reveal the vulnerability.
33 
34-- Robby: robby [at] planetargon.com
35-- Marc: hello [at] mcornella.com
36+Instead, you should email the maintainers directly at: [**security@ohmyz.sh**](mailto:security@ohmyz.sh).
37 
38-**Do not open an issue or Pull Request directly**, because it might reveal the vulnerability.
39+We will deal with the vulnerability privately and submit a patch as soon as possible.
40+