<template>
	<div class="markdown-body">
		<h1>Security Notice</h1>

		<p>
			This is the security notice for all Modrinth repositories. The notice explains how
			vulnerabilities should be reported.
		</p>
		<h2>Reporting a Vulnerability</h2>
		<p>
			If you've found a vulnerability, we would like to know so we can fix it before it is released
			publicly.
			<strong>Do not open a GitHub issue for a found vulnerability</strong>.
		</p>
		<p>
			Send details to <a href="mailto:support@modrinth.com">support@modrinth.com</a>
			including:
		</p>
		<ul>
			<li>the website, page or repository where the vulnerability can be observed</li>
			<li>a brief description of the vulnerability</li>
			<li>
				optionally the type of vulnerability and any related
				<a href="https://www.owasp.org/index.php/Category:OWASP_Top_Ten_2017_Project">
					OWASP category
				</a>
			</li>
			<li>non-destructive exploitation details</li>
		</ul>
		<p>We will do our best to reply as fast as possible.</p>
		<h2>Scope</h2>
		<p>The following vulnerabilities <strong>are not</strong> in scope:</p>
		<ul>
			<li>
				volumetric vulnerabilities, for example overwhelming a service with a high volume of
				requests
			</li>
			<li>
				reports indicating that our services do not fully align with "best practice", for example
				missing security headers
			</li>
		</ul>
		<p>If you aren't sure, you can still reach out via email or direct message.</p>
		<hr />
		<p>
			This notice is inspired by the
			<a href="https://www.pythondiscord.com/pages/security-notice/">
				Python Discord Security Notice</a
			>.
		</p>
		<p><em>Version 2026-03</em></p>
	</div>
</template>

<script setup>
const description =
	'The Security Notice of Modrinth, an open source modding platform focused on Minecraft.'

useSeoMeta({
	title: 'Security Notice - Modrinth',
	description,
	ogTitle: 'Security Notice',
	ogDescription: description,
})
</script>
