From b925ab48ba53342b6fbbc20775fd4126c80b48b0 Mon Sep 17 00:00:00 2001
From: Solaris-star <67425364+Solaris-star@users.noreply.github.com>
Date: Thu, 23 Jul 2026 00:04:51 +0800
Subject: [PATCH] docs: add SECURITY.md for private vulnerability reporting
 (#2305)

Provide a clear private disclosure path so researchers are not forced
to file public issues when Private Vulnerability Reporting is not
enabled.

Fixes #2304

Signed-off-by: Solaris-star <820622658@qq.com>
---
 SECURITY.md | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..90a2407f
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,32 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are provided for the latest `main` branch and the most recent published releases. Please upgrade when possible.
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+If you believe you have found a security vulnerability in PrivateGPT, report it privately so maintainers can investigate and remediate before public disclosure.
+
+### Preferred channels
+
+1. **GitHub Private Vulnerability Reporting** (when enabled on this repository): use the **Security** tab → **Report a vulnerability**.
+2. **Discord**: join the [PrivateGPT Discord](https://discord.gg/F8KCFeZbkx) and ask a maintainer for a private channel — do not paste exploit details in public channels.
+3. **X / social**: [@ZylonPrivateGPT](https://twitter.com/ZylonPrivateGPT) can be used only to request a private contact path, not to share technical details.
+
+Please include:
+
+- A description of the issue and its impact
+- Steps to reproduce (or a proof of concept)
+- Affected component(s), versions, and environment details
+- Any suggested remediation if known
+
+### What to expect
+
+- We will acknowledge receipt as soon as possible.
+- We will keep you informed of investigation and remediation progress.
+- Please allow a reasonable window to fix and release a patch before public disclosure.
+
+Thank you for helping keep PrivateGPT and its users safe.