From 901e6335cc80b0f12e46a1e34bd85e983dd78a6e Mon Sep 17 00:00:00 2001 From: squidfunk Date: Mon, 6 Jul 2026 12:59:25 +0200 Subject: [PATCH] Added `SECURITY.md` with EOL notice Signed-off-by: squidfunk --- SECURITY.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..ca867d36e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,37 @@ +# Security policy + +## Reporting a vulnerability + +We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly. + +**Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.** + +Instead, please send a report to martin.donath@squidfunk.com with the following information: + +1. A description of the vulnerability and its potential impact. +2. The steps required to reproduce the issue. +3. Any relevant files, screenshots, or proof-of-concept code. +4. Your name and contact information, if you would like to be credited. + +## Our commitment + +We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following: + +- **Acknowledgement** within 3 business days of your report. +- **Regular updates** on our progress as we investigate and address the issue. +- **Confidentiality** – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it. +- **Credit** – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like. + +## Supported versions + +We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on **November 5, 2026**. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches. + +After **November 5, 2026**, Material for MkDocs will no longer receive public security updates as part of standard maintenance. + +Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options. + +## Scope + +This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly. + +We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.