From 3f7433eeab9120b41d567c5724b5efb8f7f017a1 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Wed, 7 Oct 2026 21:42:31 -0700 Subject: [PATCH] Say SECURITY.md covers a project in maintenance mode SECURITY.md still said ihasmail is under active development. It now says what maintenance mode covers: security fixes, dependency updates, Stalwart compatibility and small bug fixes. It also names GitHub's private vulnerability reporting, which is enabled on the mirror, as a second private route, and no longer says "GitHub issue" now that issues live on Gitea. --- SECURITY.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 51735ff..b73175b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## Supported Versions -ihasmail is under active development. Security fixes are applied to the latest release on the `main` branch. Older tags/releases are not guaranteed to receive backported fixes. +ihasmail is in maintenance mode: it receives security fixes, dependency updates, Stalwart compatibility fixes and small bug fixes, but no new features. Security fixes are applied to the latest release on the `main` branch. Older tags/releases are not guaranteed to receive backported fixes. | Version | Supported | | ------------- | ------------------ | @@ -11,11 +11,12 @@ ihasmail is under active development. Security fixes are applied to the latest r ## Reporting a Vulnerability -**Please do not open a public GitHub issue for security vulnerabilities.** Public issues are visible to everyone, including potential attackers, before a fix is available. +**Please do not open a public issue for security vulnerabilities.** Public issues are visible to everyone, including potential attackers, before a fix is available. -Instead, report security issues privately by emailing: +Instead, report security issues privately in either of these ways: -**securityATcoffeylabsDOTorg** +- Email **securityATcoffeylabsDOTorg** +- Use [GitHub's private vulnerability reporting](https://github.com/Coffey-Labs/ihasmail/security/advisories/new) on the mirror Please include as much of the following as you can: -- 2.54.0