Add CVE disclosure to security policy (#11037)

astral-sh · Jan 28, 2025 · a9f3552 · a9f3552
1 parent f1840c7
commit a9f3552
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/SECURITY.md b/SECURITY.md
@@ -21,3 +21,8 @@ If you have found a possible vulnerability that is not excluded by the above
 
 While we sincerely appreciate and encourage reports of suspected security problems, please note that
 Astral does not currently run any bug bounty programs.
+
+## Vulnerability disclosures
+
+Critical vulnerabilities will be disclosed via GitHub's
+[security advisory](https://github.com/astral-sh/uv/security) system.