docs(security): name an email security contact

GitHub private reporting stays the primary channel. The address gives
reporters without GitHub a private route and matches the primary_contact
used for the OSS Scanner enrolment, which checks SECURITY.md for it.
This commit is contained in:
MHSanaei committed 2026-10-11 22:44:39 +02:00
1 parent eb498a3c13
commit 8fe7be943f
1 file changed
+4
+4
View File
@@ -12,6 +12,10 @@ repository's **Security** tab and click **Report a vulnerability**. Include
the affected 3x-ui version, reproduction steps, and the impact you see. the affected 3x-ui version, reproduction steps, and the impact you see.
You will receive replies in the advisory thread. You will receive replies in the advisory thread.
If you cannot use GitHub's private reporting, email the security contact
at ho3ein.sanaei@gmail.com. Automated reports from Anthropic's OSS Scanner
also go to this address.
There is no bug-bounty program. Fixes ship in the next release, and the There is no bug-bounty program. Fixes ship in the next release, and the
advisory is published after a fixed version is available. advisory is published after a fixed version is available.