From 8e890431fc3e3d7362debc99a3e5593a6c23e7f1 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sat, 31 Oct 2026 14:16:37 -0700 Subject: [PATCH] SECURITY.md: say we don't forward reports upstream A report that also affects upstream Stalwart is fixed here, and the reporter is told so they can report it to Stalwart Labs themselves. The old text promised to pass reports on, which we don't do. --- SECURITY.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 780d1760..d4cd4cb3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -32,9 +32,9 @@ Include as much as you can of: - anything about the deployment that matters — backend, front ends, whether it needs an authenticated account. -You'll get an acknowledgement within a few days. If a report turns out to -affect upstream Stalwart rather than this fork's own code, it will be passed -to Stalwart Labs with credit to you, and you'll be told that has happened. +You'll get an acknowledgement within a few days. If the problem is also in +upstream Stalwart, it still gets fixed here, and you'll be told so you can +report it to Stalwart Labs yourself. We don't forward reports to them. ## Scope -- 2.54.0