From 519b3d1f0db7f48fb7d1a0a9e6802f06165d7dfc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Mon, 27 Oct 2025 11:24:14 +0100 Subject: [PATCH] docs: add security escalation policy (#6025) --- SECURITY.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index a75e67126..04c00ab07 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -33,3 +33,9 @@ directly to the Lodash maintainers through the [Security tab](https://github.com repository. Your efforts to responsibly disclose your findings are sincerely appreciated. + +## Escalation + +If you do not receive an acknowledgement of your report within 6 business days, or if you cannot find a private security contact for the project, you may escalate to the OpenJS Foundation CNA at `security@lists.openjsf.org`. + +If the project acknowledges your report but does not provide any further response or engagement within 14 days, escalation is also appropriate.