From fa9969be75966ae23e1aaf3f309d4a948d0125ed Mon Sep 17 00:00:00 2001 From: Kamran Abdul Aziz Date: Fri, 28 Aug 2026 19:57:02 +0530 Subject: [PATCH] Add security policy Adapts the security policy the Hosting Team merged in WordPress/hosting-handbook#410. The scope section is rewritten for this repository, because the runner is executable tooling rather than a documentation repository: the policy covers the code and configuration here, directs vulnerability reports for the runner scripts to the official WordPress reporting channels instead of public issues, and keeps ordinary bugs in the public issue tracker. Placed in .github/ so GitHub surfaces it on the Security tab and in report flows. Fixes #322. --- .github/SECURITY.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/SECURITY.md diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 0000000..1d8dd95 --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1,23 @@ +# Security Policy + +## Supported scope + +The WordPress PHPUnit Test Runner is the tooling hosting providers use to run the WordPress core test suite and report results. This repository contains those scripts and their GitHub configuration. + +This policy covers security-sensitive issues in the code and configuration of this repository. It does not define support for WordPress core, plugins, themes, hosting stacks, server packages, or hosting platforms. + +## Reporting vulnerabilities + +For WordPress core, plugins, themes, WordPress.org, or the wider WordPress ecosystem, follow the official [WordPress security reporting guidance](https://wordpress.org/about/security/). WordPress core vulnerabilities should be reported through the [WordPress HackerOne program](https://hackerone.com/wordpress). + +Do not report exploitable security vulnerabilities in public GitHub issues or pull requests. For a vulnerability in the test runner scripts themselves, use the reporting channels from the official guidance above rather than a public issue, so hosts running the tooling are not exposed before a fix is available. + +If the vulnerability is in a hosting platform, server package, or other third-party project, report it to that project or vendor through their security reporting process. + +## Other issues + +If you find a bug or an insecure default in the test runner that is not an exploitable vulnerability, open a public issue in this repository: + +https://github.com/WordPress/phpunit-test-runner/issues + +Include the affected script, the behaviour you observed, and any safer replacement you are suggesting. Do not include exploit details or private vulnerability information in public issues.