Skip to content

Update SECURITY.md for clarity and remove old content #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
An0n-01 merged 1 commit into from
May 22, 2026
Merged

Update SECURITY.md for clarity and remove old content #82

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 3 additions & 8 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

## Supported Versions

Only the latest published version of `@projgen/cli` on npm receives security fixes. Older versions are not actively patched.
Only the latest published major version of `@projgen/cli` on npm receives security fixes. Older versions are not actively patched.

| Version | Supported |
| ------- | ------------------ |
Expand All @@ -13,10 +13,9 @@ Only the latest published version of `@projgen/cli` on npm receives security fix

**Please do not open a public GitHub issue for security vulnerabilities.**

If you discover a security vulnerability in `@projgen/cli` or the Projgen core, please report it responsibly through one of the following channels:
If you discover a security vulnerability in `@projgen/cli` or the Projgen core, please report it responsibly through the following channels:

- **GitHub Private Security Advisory** (preferred): [Report a vulnerability](https://github.com/Projgen/core/security/advisories/new)
- **Email**: If you cannot use GitHub's advisory system, contact the maintainer directly. You can find contact information via the [npm package page](https://www.npmjs.com/package/@projgen/cli) or the author's GitHub profile [@LorisRue](https://github.com/LorisRue).

### What to include

Expand Down Expand Up @@ -71,14 +70,10 @@ The following are **out of scope**:

When using `@projgen/cli`, keep the following in mind:

- **Only use trusted templates.** Template files (`.projgen.yaml` / `template.schema.json`) can define post-install commands and file generation logic. Review templates from third-party sources before running them.
- **Only use trusted templates.** Template files can define post-install commands and file generation logic. Review templates from third-party sources before running them.
- **Keep the CLI up to date.** Always run the latest version: `npm install -g @projgen/cli@latest`
- **Audit your dependencies.** Run `npm audit` regularly in projects generated by Projgen to catch vulnerabilities in scaffolded dependency trees.

## Dependency Security

This project uses [Dependabot](https://docs.github.com/en/code-security/dependabot) (or manual audits) to monitor known vulnerabilities in dependencies such as `yargs`, `inquirer`, `cross-spawn`, and `zod`. Security updates to runtime dependencies will be fast-tracked and released as patch versions.

---

_Last updated: May 2026_
Loading