From fc1f73ae204d116c49e501c471c7a6d0859fa750 Mon Sep 17 00:00:00 2001
From: BagToad <47394200+BagToad@users.noreply.github.com>
Date: Tue, 22 Sep 2026 09:16:37 -0600
Subject: [PATCH] Prioritize HackerOne for vulnerability reports

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/ISSUE_TEMPLATE/bug_report.md |  8 ++++++++
 .github/ISSUE_TEMPLATE/config.yml    |  6 ++++++
 .github/SECURITY.md                  | 10 ++++------
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index bcf55c2573c..ff365bde289 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -7,6 +7,14 @@ assignees: ''
 
 ---
 
+<!--
+For security vulnerabilities, first report through GitHub's bug bounty program:
+https://hackerone.com/github
+For other security-related concerns or questions, report privately through GitHub
+Security Advisories: https://github.com/cli/cli/security/advisories
+Do not use public issues for security reports or questions.
+-->
+
 ### Describe the bug
 
 A clear and concise description of what the bug is. 
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 0cad7e02ccc..bacec68e359 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1,11 @@
 blank_issues_enabled: true
 contact_links:
+  - name: Report a security vulnerability
+    about: Report vulnerabilities first through GitHub's bug bounty program on HackerOne.
+    url: https://hackerone.com/github
+  - name: Other security concerns or questions
+    about: Use this repository's private GitHub Security Advisory reporting flow.
+    url: https://github.com/cli/cli/security/advisories
   - name: Ask a question on how to use GitHub CLI
     about: For general-purpose questions and answers, see the Discussions section.
     url: https://github.com/cli/cli/discussions
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index 76bb91fc79e..cfb9b0f0a47 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -1,13 +1,11 @@
 GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as [cli](https://github.com/cli).
 
-If you believe you have found a security vulnerability in GitHub CLI, you can report it to us in one of two ways:
+If you believe you have found a security vulnerability in GitHub CLI, **report it first** through GitHub's bug bounty program on [HackerOne][].
 
-* Report it to this repository directly using [private vulnerability reporting][].
-  * Include a description of your investigation of the GitHub CLI's codebase and why you believe an exploit is possible.
-  * POCs and links to code are greatly encouraged.
-  * Such reports are not eligible for a bounty reward.
+* Include a description of your investigation of the GitHub CLI's codebase and why you believe an exploit is possible.
+* POCs and links to code are greatly encouraged.
 
-* Submit the report through [HackerOne][] to be eligible for a bounty reward.
+For other security-related concerns or questions, use this repository's [private GitHub Security Advisory (GHSA) reporting flow][private vulnerability reporting].
 
 **Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**