snapshot of https://github.com/ueberdosis/tiptap.git (main, 2026-09-15; blobs > 131072B omitted)

SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Reporting Vulnerabilities
+
+If you discover a security vulnerability in Tiptap, please report it responsibly. We appreciate your help in keeping our users safe.
+
+### How to Report
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Send details to security@tiptap.dev. Include a description of the vulnerability, steps to reproduce, and any potential impact.
+
+We will acknowledge receipt within 48 hours and provide updates as we investigate.
+
+## Response Process
+
+Vulnerabilities are assessed and prioritized based on severity, exploitability, and business impact. Fixes are deployed according to the following timelines:
+
+- **Critical** (e.g., remote code execution, data breaches): Fixed and released within 24 hours.
+- **High** (e.g., significant data exposure): Fixed and released within 72 hours.
+- **Medium** (e.g., moderate leaks): Fixed and released within 14 days.
+- **Low** (e.g., minor issues): Addressed in the next scheduled update.
+
+We follow responsible disclosure practices and will credit reporters unless requested otherwise.
+
+## Scope
+
+This policy applies to all Tiptap packages and related infrastructure. Reports are handled through our established vulnerability management process.
+
+## Contact
+
+For questions, email security@tiptap.dev or humans@tiptap.dev.