Skip to content

Add repository security policy #410

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ekamran wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add repository security policy #410

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
# Security Policy

## Supported scope

The WordPress Hosting Handbook is a documentation repository. It does not ship WordPress core, plugins, themes, hosting software, or server packages.

This policy covers security-sensitive issues in this repository's documentation and GitHub configuration. It does not define support for WordPress software versions, hosting stacks, plugins, themes, server packages, or hosting platforms.

## Reporting vulnerabilities

For WordPress core, plugins, themes, WordPress.org, or the wider WordPress ecosystem, follow the official [WordPress security reporting guidance](https://wordpress.org/about/security/). WordPress core vulnerabilities should be reported through the [WordPress HackerOne program](https://hackerone.com/wordpress).

Do not report exploitable security vulnerabilities in public GitHub issues or pull requests.

If the vulnerability is in a hosting platform, server package, or other third-party project, report it to that project or vendor through their security reporting process.

## Documentation issues

If you find an insecure, outdated, or unclear recommendation in the Hosting Handbook documentation, open a public issue in this repository:

https://github.com/WordPress/hosting-handbook/issues

Include the affected page, the specific recommendation, and any safer source or replacement guidance you are suggesting. Do not include exploit details or private vulnerability information in public issues.