dunglas / mercure

84%

master: 93%

LAST BUILD ON BRANCH docs/security-policy

branch: docs/security-policy

CHANGE BRANCH

x

Reset

• docs/security-policy
• ab/redis-fix
• add-favicon
• asyncapi
• aureleoules-master
• auth-schema
• automaxprocs
• awesome
• benchmark
• better-engine
• better-tls
• blackfire
• bolt-fill-percent
• build/release
• build/semver
• bump-deps
• bump/open-telemetry
• cache-control-private
• caddy/set_default_write_timeout
• caddy/upgrade
• chart-signed-and-schema
• chat
• chat-room-example
• chore/bump
• chore/bump-deps
• chore/bump-deps-2026-04
• chore/bump-deps-2026-05-15
• chore/bump-go-deps
• chore/bumps
• chore/caddy-2.4
• chore/cleanup-bolt-transport
• chore/deps
• chore/drop-setcap-line
• chore/example-chat-np-scope-deployment
• chore/fix-linter
• chore/go-1.17
• chore/go-1.18
• chore/go-1.21
• chore/go-1.25
• chore/go1.24
• chore/golang-jwt
• chore/golangci-lint
• chore/improve-release-script
• chore/improve-subbench
• chore/improved-error-handling
• chore/lint
• chore/linters
• chore/maxprocs-logs
• chore/modernize
• chore/modernize-code
• chore/release-tooling-prerelease
• chore/subscriber_list_bench
• chore/synctest
• chore/upgrade-chart-example-chat
• chore/upgrade-goreleaser-config
• chore/uuid-v5
• chore/workspace
• ci
• ci/32b
• ci/386
• ci/bump
• ci/bump-actions/checkout
• ci/chart-import-gpg-output
• ci/cleanup
• ci/dependabot
• ci/docs
• ci/fix-docker
• ci/fix-lint
• ci/fix-linter
• ci/fix-manif
• ci/fix-release
• ci/go1.19
• ci/gofumpt
• ci/golangci
• ci/golangci-lint-2
• ci/golangci-lint-deprecated
• ci/goreleaser
• ci/goreleaser-replacements
• ci/helm
• ci/improve
• ci/jscpd
• ci/lint
• ci/lint-caddy-module
• ci/linter
• ci/linux-arm
• ci/no-upx
• ci/npm-cache
• ci/one-release
• ci/prepare-release
• ci/release
• ci/release-char
• ci/revert-8a31d23a162a6dfc408885a0ed52fd9767874bb1
• ci/setup-qemu-for-multiarch-docker
• ci/sign
• ci/simplify-golangci-config
• ci/skip-chart-version-check
• ci/skip-sign-pr
• ci/spellcheck
• ci/super-linter
• ci/upgrade
• ci/yaml-lint
• client-docs
• cluster/secure
• cobra
• compress-option
• config-docs
• connection-events
• content-negotiation
• debug
• default-jwt-key
• dependabot/github_actions/actions/attest-build-provenance-2
• dependabot/github_actions/actions/attest-build-provenance-3
• dependabot/github_actions/actions/attest-build-provenance-4
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/setup-go-6
• dependabot/github_actions/actions/setup-node-5
• dependabot/github_actions/actions/setup-node-6
• dependabot/github_actions/actions/setup-node-6.3.0
• dependabot/github_actions/actions/setup-node-6.4.0
• dependabot/github_actions/actions/setup-python-6
• dependabot/github_actions/actions/upload-artifact-5
• dependabot/github_actions/actions/upload-artifact-6
• dependabot/github_actions/actions/upload-artifact-7
• dependabot/github_actions/crazy-max/ghaction-import-gpg-7
• dependabot/github_actions/docker/login-action-4
• dependabot/github_actions/docker/login-action-4.1.0
• dependabot/github_actions/golangci/golangci-lint-action-7
• dependabot/github_actions/golangci/golangci-lint-action-8
• dependabot/github_actions/golangci/golangci-lint-action-9
• dependabot/github_actions/golangci/golangci-lint-action-9.2.0
• dependabot/github_actions/goreleaser/goreleaser-action-7
• dependabot/github_actions/goreleaser/goreleaser-action-7.1.0
• dependabot/github_actions/goreleaser/goreleaser-action-7.2.1
• dependabot/github_actions/goreleaser/goreleaser-action-7.2.2
• dependabot/github_actions/losisin/helm-values-schema-json-action-3
• dependabot/github_actions/super-linter/super-linter-8
• dependabot/go_modules/caddy/filippo.io/edwards25519-1.1.1
• dependabot/go_modules/caddy/github.com/MicahParks/jwkset-0.6.0
• dependabot/go_modules/caddy/github.com/go-chi/chi/v5-5.2.2
• dependabot/go_modules/caddy/github.com/go-jose/go-jose/v3-3.0.5
• dependabot/go_modules/caddy/github.com/go-jose/go-jose/v4-4.0.5
• dependabot/go_modules/caddy/github.com/go-jose/go-jose/v4-4.1.4
• dependabot/go_modules/caddy/github.com/slackhq/nebula-1.9.7
• dependabot/go_modules/caddy/github.com/smallstep/certificates-0.29.0
• dependabot/go_modules/caddy/github.com/smallstep/certificates-0.30.0
• dependabot/go_modules/caddy/golang.org/x/crypto-0.35.0
• dependabot/go_modules/caddy/golang.org/x/crypto-0.45.0
• dependabot/go_modules/caddy/golang.org/x/net-0.36.0
• dependabot/go_modules/caddy/google.golang.org/grpc-1.79.3
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.0
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.1
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.14
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.16
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.2
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.4
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.5
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.6
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.20.8
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.21.0
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.21.3
• dependabot/maven/gatling/io.gatling-gatling-maven-plugin-4.21.5
• dependabot/maven/gatling/io.gatling.highcharts-gatling-charts-highcharts-3.14.4
• dependabot/maven/gatling/io.gatling.highcharts-gatling-charts-highcharts-3.14.5
• dependabot/maven/gatling/io.gatling.highcharts-gatling-charts-highcharts-3.14.6
• dependabot/maven/gatling/io.gatling.highcharts-gatling-charts-highcharts-3.14.7
• dependabot/maven/gatling/io.gatling.highcharts-gatling-charts-highcharts-3.14.9
• dependabot/maven/gatling/io.gatling.highcharts-gatling-charts-highcharts-3.15.0
• dependabot/maven/gatling/net.alchim31.maven-scala-maven-plugin-4.9.10
• dependabot/maven/gatling/net.alchim31.maven-scala-maven-plugin-4.9.7
• dependabot/maven/gatling/net.alchim31.maven-scala-maven-plugin-4.9.8
• dependabot/maven/gatling/net.alchim31.maven-scala-maven-plugin-4.9.9
• dependabot/maven/gatling/org.apache.maven.plugins-maven-compiler-plugin-3.14.1
• dependabot/maven/gatling/org.apache.maven.plugins-maven-compiler-plugin-3.15.0
• dependabot/maven/gatling/org.apache.maven.plugins-maven-resources-plugin-3.4.0
• dependabot/maven/gatling/org.apache.maven.plugins-maven-resources-plugin-3.5.0
• dependabot/npm_and_yarn/conformance-tests/minimatch-and-playwright/test--removed
• dependabot/npm_and_yarn/conformance-tests/minimist-1.2.6
• dependabot/npm_and_yarn/conformance-tests/multi-a50d7f32cf
• docker
• docker-rootless-healthcheck
• docs
• docs-trainings
• docs/726
• docs/badge
• docs/boltdbweb
• docs/caddy
• docs/caddy-2.6
• docs/caddy-module
• docs/cloud
• docs/cluster
• docs/config
• docs/cors
• docs/debug
• docs/default-url
• docs/fix-xcaddy
• docs/github-actions
• docs/golib
• docs/hotwire
• docs/improve
• docs/improve-stimulus-controller
• docs/improvements
• docs/license
• docs/managed
• docs/php
• docs/playwright
• docs/quarantine
• docs/rolling-updates
• docs/rootless-helm-targetport
• docs/traefik
• docs/typo-ha
• docs/update
• docs/updated-cluster
• docs/upgrade-0.14
• docs/upgrade-deprecated
• docs/valkey
• docs/vscode
• dunglas-patch-1
• duplex
• earliest
• enable-heartbeat-default
• feat/579
• feat/add-annotations-for-deployment
• feat/allow-no-publish
• feat/automemlimit
• feat/caddy-2.10
• feat/caddy-2.5
• feat/caddy-2.7
• feat/caddy-2.7.3
• feat/caddy-2.9
• feat/caddyfile
• feat/chart-default-no-sa-token
• feat/chart-httproute-timeouts
• feat/chart-network-policy
• feat/chart-readonly-rootfs
• feat/chart-rootless-defaults
• feat/chart-rootless-securitycontext-example
• feat/chat-example-deps-security
• feat/config
• feat/conformance-tests
• feat/cookie-name
• feat/cors-wildcard
• feat/custom-server-header
• feat/db-volume
• feat/debug-authorization
• feat/debug-subscriptions
• feat/default-metrics-login
• feat/demo-ui-rewrite
• feat/deprecate-ristretto-usage
• feat/embedded-ui
• feat/example-chat-chart
• feat/examples-chat-chart-hardening
• feat/finished-slog
• feat/helm
• feat/helm-deployment-strategy
• feat/homepage
• feat/hpa-install-replicas
• feat/hpa-passthrough
• feat/httproute
• feat/jwks-file-url
• feat/jwt-rs256
• feat/load-test-private
• feat/openapi
• feat/otel-tracing
• feat/protocol-compat
• feat/publish
• feat/release-app-token
• feat/release-workflow
• feat/ristretto
• feat/slsa-attestation-coverage
• feat/timeouts
• feat/topic-matchers
• feat/transport-health
• feat/ui-path
• feat/upstream-version-metrics
• feat/urlpattern
• feat/validate-origins
• feat/version
• feat/zap
• feature/restrict-public-updates
• finish-190
• fix-178
• fix-282
• fix-block
• fix-cors
• fix-goreleaser
• fix-linter
• fix-multi-topics
• fix-spec
• fix-syntax
• fix/1012
• fix/1024
• fix/1141
• fix/394
• fix/404
• fix/435
• fix/463
• fix/464
• fix/471
• fix/559
• fix/632
• fix/651
• fix/666
• fix/677
• fix/758
• fix/810
• fix/ERR_INCOMPLETE_CHUNKED_ENCODING
• fix/TopicSelectorCachedisabling
• fix/TransportError
• fix/active-subscriptions-ui
• fix/add-back-WriteTimeoutContextKey
• fix/bolt-path
• fix/bolt-unknown-lasteventid
• fix/build
• fix/cache
• fix/cache-size
• fix/change-default-jwt-key
• fix/chart-annot
• fix/chart-data-volume-always
• fix/chart-issues
• fix/ci
• fix/cluster-helm-chart
• fix/ctx-cancel
• fix/deadlock
• fix/debug-ui
• fix/debug-unsubscribe
• fix/demo-cookie-security
• fix/dispatch_timeout
• fix/export
• fix/expose-caddy-structs
• fix/flaky-test-unknown-last-event-id
• fix/goreleaser
• fix/graceful-shutdown
• fix/hashPool
• fix/helm-chart
• fix/home
• fix/html
• fix/jwt-alg
• fix/linter
• fix/linters
• fix/log-security
• fix/logging-error-handling
• fix/logs
• fix/mem-usage
• fix/potential-panic
• fix/relax-scheme
• fix/remove-arm32
• fix/response-last-event-id
• fix/secret-helm
• fix/security
• fix/stopping
• fix/subscription-api-auth
• fix/tests
• fix/thundering-herd
• fix/timer-memory
• fix/topic-selector-cache-default
• fix/topologySpreadConstraints
• fix/transport-assign-id
• fix/tss
• fix/url
• fix/write-timeout-transport
• fix/zizmor-workflow-audits
• fix_178
• fix_deploys
• flush-missed
• force-body
• gatling
• github-actions
• go-deadlock
• gofrs/uuid
• golangci-lint
• healthz
• heartbeat
• helm/docs
• history-cleanup
• homepage
• iana
• improved-debug-ui
• jwt-logs
• kubernetes
• logger-init
• logo
• macos-tests
• main
• master
• memory
• mention-caddyfile-change
• mercure_metric_naming
• nginx
• openapi
• patch-1
• patch-2
• patch-helm
• perf/bolt
• perf/optims
• performance-docs
• pgo
• private-updates
• quality
• race
• refactor/1.20-deadline
• refactor/AssignUUID
• refactor/FindHub
• refactor/deprecated
• refactor/linters
• refactor/subscriber-list-encoding
• refactor/subscribers
• refactor/tss
• refactoring
• refs/tags/caddy/v0.11.3
• refs/tags/caddy/v0.12.0
• refs/tags/caddy/v0.12.1
• refs/tags/caddy/v0.12.2
• refs/tags/caddy/v0.13.0
• refs/tags/caddy/v0.14.0
• refs/tags/caddy/v0.14.0-beta.1
• refs/tags/caddy/v0.14.0-beta.2
• refs/tags/caddy/v0.14.1
• refs/tags/caddy/v0.14.10
• refs/tags/caddy/v0.14.2
• refs/tags/caddy/v0.14.3
• refs/tags/caddy/v0.14.4
• refs/tags/caddy/v0.14.5
• refs/tags/caddy/v0.14.6
• refs/tags/caddy/v0.14.7
• refs/tags/caddy/v0.14.8
• refs/tags/caddy/v0.14.9
• refs/tags/caddy/v0.15.0
• refs/tags/caddy/v0.15.1
• refs/tags/caddy/v0.15.2
• refs/tags/caddy/v0.15.3
• refs/tags/caddy/v0.15.4
• refs/tags/caddy/v0.15.5
• refs/tags/mercure-0.12.0
• refs/tags/v0.10.0
• refs/tags/v0.10.0-beta.1
• refs/tags/v0.10.1
• refs/tags/v0.10.2
• refs/tags/v0.10.3
• refs/tags/v0.10.4
• refs/tags/v0.11.0
• refs/tags/v0.11.0-beta.1
• refs/tags/v0.11.0-beta.2
• refs/tags/v0.11.0-rc.1
• refs/tags/v0.11.0-rc.2
• refs/tags/v0.11.0-rc.3
• refs/tags/v0.11.1
• refs/tags/v0.11.2
• refs/tags/v0.11.3
• refs/tags/v0.12.0
• refs/tags/v0.12.1
• refs/tags/v0.12.2
• refs/tags/v0.13.0
• refs/tags/v0.14.0
• refs/tags/v0.14.0-beta.1
• refs/tags/v0.14.0-beta.2
• refs/tags/v0.14.1
• refs/tags/v0.14.10
• refs/tags/v0.14.2
• refs/tags/v0.14.3
• refs/tags/v0.14.4
• refs/tags/v0.14.5
• refs/tags/v0.14.7
• refs/tags/v0.14.8
• refs/tags/v0.14.9
• refs/tags/v0.15.1
• refs/tags/v0.15.10
• refs/tags/v0.15.11
• refs/tags/v0.15.3
• refs/tags/v0.15.4
• refs/tags/v0.15.5
• refs/tags/v0.15.6
• refs/tags/v0.15.7
• refs/tags/v0.15.8
• refs/tags/v0.15.9
• refs/tags/v0.16.0
• refs/tags/v0.16.1
• refs/tags/v0.16.2
• refs/tags/v0.16.3
• refs/tags/v0.17.0
• refs/tags/v0.17.1
• refs/tags/v0.18.0
• refs/tags/v0.18.1
• refs/tags/v0.18.2
• refs/tags/v0.18.3
• refs/tags/v0.18.4
• refs/tags/v0.19.0
• refs/tags/v0.19.1
• refs/tags/v0.19.2
• refs/tags/v0.19.3
• refs/tags/v0.20.0
• refs/tags/v0.20.1
• refs/tags/v11.0.0-beta.1
• return_id
• revamp-spec
• review-subscriber-performance
• schemas
• spec/abstract
• spec/allow-strings-as-id
• spec/auth
• spec/cherry-pick
• spec/clarify
• spec/fragment
• spec/freddie
• spec/implementation-status
• spec/lastEventID
• spec/openapi-enhancements
• spec/other-protocols
• spec/publisher-authorization
• spec/remove-cookie-name-discovery
• spec/subscription-api
• spec/topic-selectors
• start-logs
• subscription-api
• subscription-api-implem
• test-raw-string
• test-release
• test/800
• test/compat
• test/fix-test-parallel
• test/parallel
• tests/deadcode
• tests/fuzz-publish
• tests/modernize
• transport-deprecation
• troubleshooting
• update-deps
• use-forwarded-headers
• uuid-urn
• v0.1.0
• v0.2.0
• v0.2.1
• v0.2.2
• v0.2.3
• v0.2.4
• v0.2.5
• v0.3.0
• v0.3.1
• v0.3.2
• v0.3.3
• v0.4.0
• v0.4.1
• v0.4.2
• v0.5.0
• v0.5.1
• v0.6.0
• v0.6.1
• v0.6.2
• v0.7.0
• v0.7.1
• v0.7.2
• v0.8.0
• v0.8.1
• v0.9.0
• vscode
• well-known
• windows

Build # 26456431174

Build Type

Pull #1257

github

Committed by dunglas

Commit Message

docs: add SECURITY.md with maintenance policy

Document the 0.x maintenance branch and the 1.0.0-beta line on main,
and point reporters at GitHub's private vulnerability reporting.

Pull Request Pull Request #1257: docs: add SECURITY.md with maintenance policy

Coverage Stats

1807 of 2154 relevant lines covered (83.89%)

49.84 hits per line