tedious 20.3.0 → 20.3.2

package/README.md

@@ -53,6 +53,9 @@ We'd like to learn more about how you use tedious:
 ## Contributing
 We welcome contributions from the community. Feel free to checkout the code and submit pull requests.
 
+## Security
+Please report security vulnerabilities privately. See our [security policy](SECURITY.md) for reporting instructions.
+
 <a name="license"></a>
 ## License
 

package/SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report suspected security issues in Tedious privately using
+[GitHub's private vulnerability reporting](https://github.com/tediousjs/tedious/security/advisories/new).
+You can also open the repository's **Security** tab, select **Advisories**, and
+click **Report a vulnerability**.
+
+Do not disclose vulnerabilities in public issues, discussions, or pull requests.
+Reports submitted through this process are private and are not automatically
+published as security advisories.
+
+Include the following details where possible:
+
+- A description of the vulnerability and its potential impact.
+- The affected Tedious version and relevant environment details.
+- Steps to reproduce the issue or a minimal proof of concept.
+- Any suggested fix or workaround.
+
+Do not include credentials, secrets, or sensitive customer data in your report.
+Use the private report to discuss the issue with the maintainers and coordinate
+any public disclosure.