From 43e42eb3b3c1dab733c51b653f5b51c2a9a74b61 Mon Sep 17 00:00:00 2001
From: blackcoffeexbt <87530449+blackcoffeexbt@users.noreply.github.com>
Date: Fri, 7 Aug 2026 14:16:49 +0100
Subject: [PATCH] Add security.md (#4126)

---
 SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..2d0d1b64b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,36 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are provided for the current released version of LNbits and the
+`dev` branch. Older releases and release candidates are not supported unless a
+maintainer explicitly states otherwise.
+
+| Version            | Supported |
+| ------------------ | --------- |
+| Current release    | Yes       |
+| `dev` branch       | Yes       |
+| Older releases     | No        |
+| Release candidates | No        |
+
+## Reporting a Vulnerability
+
+Please report suspected vulnerabilities privately using [GitHub's private
+vulnerability reporting](https://github.com/lnbits/lnbits/security/advisories/new).
+Do not open a public issue, discussion, or pull request for a security
+vulnerability.
+
+Include enough detail for maintainers to reproduce and assess the issue, such
+as the affected version or commit, configuration, steps to reproduce, impact,
+and any proof of concept. Do not include credentials, API keys, wallet data, or
+other sensitive information unless it is necessary and can be shared safely.
+
+Maintainers will acknowledge the report, investigate it, and coordinate a fix
+and disclosure timeline with you. Please allow time for a fix to be prepared
+before publicly disclosing the vulnerability.
+
+## Scope
+
+This policy covers the LNbits core repository and LNbits extensions in the LNbits GitHub organisation. Vulnerabilities in third-party
+funding sources, dependencies or hosted LNbits instances may need to be reported to their respective maintainers or
+operators as well.