trufflesecurity/trufflehog
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve security reporting guidelines in SECURITY.md

Browse Source
This commit is contained in:
Luke Marshall
2026-03-18 17:42:41 +11:00
parent afd5336caa
commit bc1d334478
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+12 -1
View File
@@ -1,4 +1,15 @@
Please report security issues to security@trufflesec.com and include `trufflehog` in the subject line. If your vulnerability involves SSRF or outbound requests, please see our policy for that specific class of vulnerability below.
Please report security issues to security@trufflesec.com and include `trufflehog` in the subject line.
## Reporting Guidelines
Truffle Security values the work of independent security researchers. To help us triage and remediate issues efficiently, please include the following in your report:
- **Summary** - brief description of the issue.
- **Proof of Concept** - steps to reproduce, including any relevant code references.
- **Impact** - the realistic impact this has on TruffleHog users.
- **Suggested Fix** (optional) - any recommendations on how to fix the issue.
If your vulnerability involves SSRF or outbound requests, please see our policy for that specific class of vulnerability below.
## Blind SSRF & Outbound Request Policy
Truffle Security treats blind SSRF (the ability to induce outbound requests without data retrieval) as a hardening opportunity rather than a vulnerability. We do not issue CVEs or formal advisories for reports showing outbound interactions unless they demonstrate a tangible security risk to users.