Skip to content

[pull] trunk from cli:trunk #255

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pull merged 2 commits into from
Sep 22, 2026
+18 −6
Merged

[pull] trunk from cli:trunk #255

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fc1f73a
Prioritize HackerOne for vulnerability reports
BagToad Sep 22, 2026
a3d31e2
Merge pull request #14497 from cli/bagtoad/cli-security-reporting-gui…
BagToad Sep 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/ISSUE_TEMPLATE/bug_report.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,14 @@ assignees: ''

---

<!--
For security vulnerabilities, first report through GitHub's bug bounty program:
https://hackerone.com/github
For other security-related concerns or questions, report privately through GitHub
Security Advisories: https://github.com/cli/cli/security/advisories
Do not use public issues for security reports or questions.
-->

### Describe the bug

A clear and concise description of what the bug is.
Expand Down
6 changes: 6 additions & 0 deletions .github/ISSUE_TEMPLATE/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
blank_issues_enabled: true
contact_links:
- name: Report a security vulnerability
about: Report vulnerabilities first through GitHub's bug bounty program on HackerOne.
url: https://hackerone.com/github
- name: Other security concerns or questions
about: Use this repository's private GitHub Security Advisory reporting flow.
url: https://github.com/cli/cli/security/advisories
- name: Ask a question on how to use GitHub CLI
about: For general-purpose questions and answers, see the Discussions section.
url: https://github.com/cli/cli/discussions
Expand Down
10 changes: 4 additions & 6 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,11 @@
GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as [cli](https://github.com/cli).

If you believe you have found a security vulnerability in GitHub CLI, you can report it to us in one of two ways:
If you believe you have found a security vulnerability in GitHub CLI, **report it first** through GitHub's bug bounty program on [HackerOne][].

* Report it to this repository directly using [private vulnerability reporting][].
* Include a description of your investigation of the GitHub CLI's codebase and why you believe an exploit is possible.
* POCs and links to code are greatly encouraged.
* Such reports are not eligible for a bounty reward.
* Include a description of your investigation of the GitHub CLI's codebase and why you believe an exploit is possible.
* POCs and links to code are greatly encouraged.

* Submit the report through [HackerOne][] to be eligible for a bounty reward.
For other security-related concerns or questions, use this repository's [private GitHub Security Advisory (GHSA) reporting flow][private vulnerability reporting].

**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**

Expand Down
Loading