From d7d27d99e7e48aff8057a002b9ec3525c567f143 Mon Sep 17 00:00:00 2001 From: zxkmm Date: Sun, 29 Mar 2026 01:14:22 +0800 Subject: [PATCH] edit security policy (#3113) --- SECURITY.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 3fd5e0ced..bc8f0fbaa 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1 +1,17 @@ -Please check [Intended-Use-and-Legality](https://github.com/portapack-mayhem/mayhem-firmware/wiki/) +# Security Policy + +## Scope and Threat Model +This repository hosts the codebase for an embedded system designed for security research. Because the system operates primarily offline, traditional network-based vulnerabilities are generally not applicable. However, we still welcome and review security reports concerning the code within this repository. + +## Reporting a Vulnerability +If you discover a vulnerability within this tool itself, please submit a report. Please be aware that the maintainers do not promise assistance with obtaining CVE IDs or managing formal security advisories. + +## Out of Scope +* **Vulnerabilities found *using* this tool:** Please do not submit reports here for vulnerabilities you have discovered in other systems or targets using this tool. This channel is strictly for reporting vulnerabilities found *in* the tool itself. +* **Other Repositories:** For security issues concerning related tools, such as MayhemHub, please submit your reports directly to their respective repositories. + +## Research Attribution +If you utilize this tool to successfully discover vulnerabilities in external systems, we would greatly appreciate it if you credit or mention our project in your published research or write-ups. + +## Legal and Security Disclaimer +For comprehensive guidelines regarding the legal and secure usage of this tool, as well as our full liability disclaimer, please refer to: [Intended-Use-and-Legality](https://github.com/portapack-mayhem/mayhem-firmware/wiki/). Users are expected to comply with all applicable laws and regulations when using this software and/or hardware.