From 39798cba1ddc53c0154da19d8fbabea781623844 Mon Sep 17 00:00:00 2001 From: Bhargavi Rao Date: Wed, 23 Sep 2026 16:00:45 -0700 Subject: [PATCH 1/2] docs: add security policy --- SECURITY.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..c573ceb63 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,24 @@ +# Security Policy + +## Reporting a Vulnerability + +BitGo takes the security of its open-source software seriously. + +If you discover a security vulnerability in a public BitGo repository, please do not report it through a public GitHub issue, discussion, or pull request. + +Please report it privately by emailing **security@bitgo.com** and include: + +- The affected repository, version, or commit +- A description of the vulnerability and its potential impact +- Steps to reproduce the issue +- Any relevant proof-of-concept material + +Please do not include credentials, private keys, or other sensitive information in the initial email. The BitGo Security team can arrange a secure transfer method if additional materials are required. + +Some BitGo products and repositories may be covered by our public Bugcrowd program. Eligibility, scope, and reward requirements are determined by the program terms: + +https://bugcrowd.com/engagements/bitgo-mbb-og-public + +Please allow the BitGo Security team a reasonable opportunity to investigate and address the issue before making any public disclosure. + +Thank you for helping keep BitGo and its users secure. From 97dd6b71164654e156d07618b146d3248eb50385 Mon Sep 17 00:00:00 2001 From: Bhargavi Rao Date: Wed, 23 Sep 2026 16:08:55 -0700 Subject: [PATCH 2/2] docs: clarify security policy scope for fork --- SECURITY.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index c573ceb63..528041ac4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,6 +4,8 @@ BitGo takes the security of its open-source software seriously. +This policy applies to BitGo-specific changes in this repository. Vulnerabilities affecting the upstream project should be reported according to the upstream project's security policy. + If you discover a security vulnerability in a public BitGo repository, please do not report it through a public GitHub issue, discussion, or pull request. Please report it privately by emailing **security@bitgo.com** and include: