From d570ef257c7896f0c3bdc551d46a9b0fe4e07c6a Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Mon, 17 Nov 2025 08:39:11 +0900 Subject: [PATCH] CONTRIBUTING.md: add security reporting guidance with link to SECURITY.md added a new "Security Issues" section that summarizes the security reporting process: email for RCE vulnerabilities, issue tracker for VM crashes. links to SECURITY.md for complete details on what qualifies as a security issue. Co-authored-by: Claude --- CONTRIBUTING.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ed5a36958..e99708f54 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -18,6 +18,15 @@ things in mind before submitting your pull request: - Use mrbgem to provide non ISO features (classes, modules and methods) unless you have a special reason to implement them in the core +## Security Issues + +If you discover a security vulnerability: + +- **High priority security vulnerabilities** (RCE): Report via email to +- **VM crashes from valid Ruby code**: Please report as regular bug reports on our issue tracker + +For detailed guidance on what qualifies as a security issue and what doesn't, see [SECURITY.md](SECURITY.md). + ## pre-commit A framework for managing and maintaining multi-language `pre-commit` hooks.