From b9d78b11461761fff19ca1735daff63b6a0d0bce Mon Sep 17 00:00:00 2001 From: Anon <206556099+An0n-01@users.noreply.github.com> Date: Thu, 21 May 2026 20:20:09 +0200 Subject: [PATCH] Update SECURITY.md for clarity and remove old content Clarified the wording regarding supported versions and reporting vulnerabilities. Removed outdated section about dependency security. --- SECURITY.md | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index c5c41cd..f62bf54 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## Supported Versions -Only the latest published version of `@projgen/cli` on npm receives security fixes. Older versions are not actively patched. +Only the latest published major version of `@projgen/cli` on npm receives security fixes. Older versions are not actively patched. | Version | Supported | | ------- | ------------------ | @@ -13,10 +13,9 @@ Only the latest published version of `@projgen/cli` on npm receives security fix **Please do not open a public GitHub issue for security vulnerabilities.** -If you discover a security vulnerability in `@projgen/cli` or the Projgen core, please report it responsibly through one of the following channels: +If you discover a security vulnerability in `@projgen/cli` or the Projgen core, please report it responsibly through the following channels: - **GitHub Private Security Advisory** (preferred): [Report a vulnerability](https://github.com/Projgen/core/security/advisories/new) -- **Email**: If you cannot use GitHub's advisory system, contact the maintainer directly. You can find contact information via the [npm package page](https://www.npmjs.com/package/@projgen/cli) or the author's GitHub profile [@LorisRue](https://github.com/LorisRue). ### What to include @@ -71,14 +70,10 @@ The following are **out of scope**: When using `@projgen/cli`, keep the following in mind: -- **Only use trusted templates.** Template files (`.projgen.yaml` / `template.schema.json`) can define post-install commands and file generation logic. Review templates from third-party sources before running them. +- **Only use trusted templates.** Template files can define post-install commands and file generation logic. Review templates from third-party sources before running them. - **Keep the CLI up to date.** Always run the latest version: `npm install -g @projgen/cli@latest` - **Audit your dependencies.** Run `npm audit` regularly in projects generated by Projgen to catch vulnerabilities in scaffolded dependency trees. -## Dependency Security - -This project uses [Dependabot](https://docs.github.com/en/code-security/dependabot) (or manual audits) to monitor known vulnerabilities in dependencies such as `yargs`, `inquirer`, `cross-spawn`, and `zod`. Security updates to runtime dependencies will be fast-tracked and released as patch versions. - --- _Last updated: May 2026_