From d6d2a8d8ad6640f9607345d755514139435596cc Mon Sep 17 00:00:00 2001 From: David Yaffe Date: Thu, 13 Aug 2026 18:43:59 -0400 Subject: [PATCH] chore: sync security-policy from cose --- SECURITY.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..7e6c238 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,23 @@ +# Security Policy + +## Vulnerability Reporting + +We deeply appreciate any effort to discover and disclose security vulnerabilities responsibly. + +### Chitchat CI + +If you would like to report a vulnerability in Chitchat's CI or have security concerns with other Datadog products, please email [security@datadoghq.com](mailto:security@datadoghq.com). + +We take all disclosures seriously and will do our best to respond promptly, verify the vulnerability, and take the necessary steps to fix it. After our initial reply, we will periodically update you on the status of the fix. + +### Other Reports + +Chitchat is an open source project. Users are responsible for managing the environments where they deploy or integrate it. Vulnerabilities in those environments could potentially be exploited by malicious actors who already have access to the user's infrastructure. We encourage responsible disclosure by emailing [security@datadoghq.com](mailto:security@datadoghq.com) so that risks can be properly assessed and mitigated. + +To help us investigate your report, please include any of the following: + +- A proof of concept +- Any tools used, including their versions +- Any relevant output + +Do not include credentials, secrets, or other sensitive information in a public GitHub issue.