SECURITY.md: say we don't forward reports upstream #281

Merged
jcoffey-dev merged 1 commits from docs/security-upstream-reports into main 2026-10-31 21:36:29 +00:00
+3 -3
View File
@@ -32,9 +32,9 @@ Include as much as you can of:
- anything about the deployment that matters — backend, front ends, whether
it needs an authenticated account.
You'll get an acknowledgement within a few days. If a report turns out to
affect upstream Stalwart rather than this fork's own code, it will be passed
to Stalwart Labs with credit to you, and you'll be told that has happened.
You'll get an acknowledgement within a few days. If the problem is also in
upstream Stalwart, it still gets fixed here, and you'll be told so you can
report it to Stalwart Labs yourself. We don't forward reports to them.
## Scope