SECURITY.md: say we don't forward reports upstream

jcoffey-dev commented

2026-10-31 21:16:52 +00:00

Owner

The policy said a report that turns out to affect upstream Stalwart would be passed to Stalwart Labs with credit. We don't do that, and their policy refuses some kinds of report, so the promise couldn't be kept.

Now: the problem still gets fixed here, and the reporter is told so they can report it upstream themselves.

Docs only; no code change.

The policy said a report that turns out to affect upstream Stalwart would be passed to Stalwart Labs with credit. We don't do that, and their policy refuses some kinds of report, so the promise couldn't be kept. Now: the problem still gets fixed here, and the reporter is told so they can report it upstream themselves. Docs only; no code change.

jcoffey-dev added 1 commit 2026-10-31 21:16:52 +00:00

SECURITY.md: say we don't forward reports upstream

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 10m6s

Details

8e890431fc

A report that also affects upstream Stalwart is fixed here, and the
reporter is told so they can report it to Stalwart Labs themselves.
The old text promised to pass reports on, which we don't do.

jcoffey-dev merged commit 379847c1bb into main

2026-10-31 21:36:29 +00:00

jcoffey-dev deleted branch docs/security-upstream-reports

2026-10-31 21:36:29 +00:00

SECURITY.md: say we don't forward reports upstream #281