BuildOneRobotics · EthanCoderPenguin2012 · Dec 12, 2025 · Copilot · Dec 12, 2025 · Copilot
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.
-Use this section to tell people how to report a vulnerability.
-
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+To report a security vulnerability, please email our security team at [[email protected]](mailto:[email protected]). If you prefer, you may use our secure reporting form at [https://example.com/security-report](https://example.com/security-report).
+
+We aim to acknowledge your report within 3 business days and provide a more detailed response within 7 business days, including our assessment of the issue and an expected timeline for resolution.
+
+Once a vulnerability is confirmed, we will work with you to address the issue and keep you informed of our progress. After the vulnerability is resolved, we will notify you before public disclosure, unless you request otherwise. If the report is declined, we will provide a clear explanation.
-Use this section to tell people how to report a vulnerability.
-
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+To report a security vulnerability, please email our security team at [[email protected]](mailto:[email protected]). If you prefer, you may use our secure reporting form at [https://example.com/security-report](https://example.com/security-report).
+
+We aim to acknowledge your report within 3 business days and provide a more detailed response within 7 business days, including our assessment of the issue and an expected timeline for resolution.
+
+Once a vulnerability is confirmed, we will work with you to address the issue and keep you informed of our progress. After the vulnerability is resolved, we will notify you before public disclosure, unless you request otherwise. If the report is declined, we will provide a clear explanation.