mirror of
https://github.com/squidfunk/mkdocs-material.git
synced 2026-07-28 00:32:42 -04:00
38 lines
2.4 KiB
Markdown
38 lines
2.4 KiB
Markdown
# Security policy
|
||
|
||
## Reporting a vulnerability
|
||
|
||
We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
|
||
|
||
**Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.**
|
||
|
||
Instead, please send a report to martin.donath@squidfunk.com with the following information:
|
||
|
||
1. A description of the vulnerability and its potential impact.
|
||
2. The steps required to reproduce the issue.
|
||
3. Any relevant files, screenshots, or proof-of-concept code.
|
||
4. Your name and contact information, if you would like to be credited.
|
||
|
||
## Our commitment
|
||
|
||
We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
|
||
|
||
- **Acknowledgement** within 3 business days of your report.
|
||
- **Regular updates** on our progress as we investigate and address the issue.
|
||
- **Confidentiality** – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
|
||
- **Credit** – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
|
||
|
||
## Supported versions
|
||
|
||
We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on **November 5, 2026**. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
|
||
|
||
After **November 5, 2026**, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
|
||
|
||
Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
|
||
|
||
## Scope
|
||
|
||
This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
|
||
|
||
We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.
|