mirror of
https://github.com/gohugoio/hugo.git
synced 2026-08-24 07:18:54 +00:00
Bjørn Erik Pedersen
12 lines
710 B
Markdown
12 lines
710 B
Markdown
## Security Policy
|
|
|
|
### Before You Report
|
|
|
|
Please read [Hugo's Security Model](https://gohugo.io/about/security/) first. If the issue reproduces in an upstream project, please report it there — we cannot triage or patch on their behalf.
|
|
|
|
### Reporting a Vulnerability
|
|
|
|
If, after the above, you believe you have found a vulnerability in Hugo itself with a concrete, reproducible impact, report it privately to **[bjorn.erik.pedersen@gmail.com](mailto:bjorn.erik.pedersen@gmail.com)**. Include a minimal reproducer, the Hugo version, and the observed vs. expected behavior.
|
|
|
|
You should receive an initial response within a few days. Confirmed issues are typically patched within days, depending on complexity.
|