manicinc · jddunn · Aug 27, 2025 · Aug 13, 2025 · Aug 13, 2025 · Aug 15, 2025
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
-| 5.1.x   | :white_check_mark: |
-| 5.0.x   | :x:                |
-| 4.0.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+| 1.2.0   | :white_check_mark: |
+| 1.1.0   | :white_check_mark: |
+| 1.0.0   | :x:                |
+| < 1.0.0 | :x:                |
-| 5.1.x   | :white_check_mark: |
-| 5.0.x   | :x:                |
-| 4.0.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+| 1.2.0   | :white_check_mark: |
+| 1.1.0   | :white_check_mark: |
+| 1.0.0   | :x:                |
+| < 1.0.0 | :x:                |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.
-Use this section to tell people how to report a vulnerability.
-
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+To report a security vulnerability, please email us at [security@example.com](mailto:security@example.com) with details of the issue.
+
+We aim to acknowledge all reports within 2 business days and provide a status update within 7 business days.
+
+After triage, we will keep you informed of our progress and may request additional information if needed. If the vulnerability is accepted, we will work with you on disclosure timing and credit. If declined, we will provide a clear explanation.
-Use this section to tell people how to report a vulnerability.
-
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+To report a security vulnerability, please email us at [security@example.com](mailto:security@example.com) with details of the issue.
+
+We aim to acknowledge all reports within 2 business days and provide a status update within 7 business days.
+
+After triage, we will keep you informed of our progress and may request additional information if needed. If the vulnerability is accepted, we will work with you on disclosure timing and credit. If declined, we will provide a clear explanation.
diff --git a/package.json b/package.json
@@ -499,7 +499,7 @@
     "tsup": "^8.0.1",
     "tsx": "^4.7.0",
     "typescript": "^5.0.4",
-    "esbuild": "^0.21.5",
+    "esbuild": "^0.25.0",
     "dependency-cruiser": "^16.6.0",
     "license-checker": "^25.0.1",
     "lockfile-lint": "4.14.1",