From 8fe7be943f16b0886eaa2721d572ad0b854846b3 Mon Sep 17 00:00:00 2001 From: MHSanaei Date: Sun, 11 Oct 2026 22:44:39 +0200 Subject: [PATCH] docs(security): name an email security contact GitHub private reporting stays the primary channel. The address gives reporters without GitHub a private route and matches the primary_contact used for the OSS Scanner enrolment, which checks SECURITY.md for it. --- SECURITY.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 88c19fb29..1e3924870 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,6 +12,10 @@ repository's **Security** tab and click **Report a vulnerability**. Include the affected 3x-ui version, reproduction steps, and the impact you see. You will receive replies in the advisory thread. +If you cannot use GitHub's private reporting, email the security contact +at ho3ein.sanaei@gmail.com. Automated reports from Anthropic's OSS Scanner +also go to this address. + There is no bug-bounty program. Fixes ship in the next release, and the advisory is published after a fixed version is available.