diff options
2 files changed, 16 insertions, 0 deletions
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 822d247..e61c9d5 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -176,6 +176,12 @@ that is fine, but please mark it as such.
=== Sending your patches.
+:security-ml: footnoteref:[security-ml,The Git Security mailing list:]
+Before sending any patches, please note that patches that may be
+security relevant should be submitted privately to the Git Security
+mailing list{security-ml}, instead of the public mailing list.
Learn to use format-patch and send-email if possible. These commands
are optimized for the workflow of sending patches, avoiding many ways
your existing e-mail client that is optimized for "multipart/*" mime
@@ -259,6 +265,13 @@ patch, format it as "multipart/signed", not a text/plain message
that starts with `-----BEGIN PGP SIGNED MESSAGE-----`. That is
not a text/plain, it's something else.
+:security-ml-ref: footnoteref:[security-ml]
+As mentioned at the beginning of the section, patches that may be
+security relevant should not be submitted to the public mailing list
+mentioned below, but should instead be sent privately to the Git
+Security mailing list{security-ml-ref}.
Send your patch with "To:" set to the mailing list, with "cc:" listing
people who are involved in the area you are touching (the output from
`git blame $path` and `git shortlog --no-merges $path` would help to
diff --git a/ b/
index f17af66..f920a42 100644
--- a/
+++ b/
@@ -36,6 +36,9 @@ the body to The mailing list archives are
available at <>,
<> and other archival sites.
+Issues which are security relevant should be disclosed privately to
+the Git Security mailing list <>.
The maintainer frequently sends the "What's cooking" reports that
list the current status of various development topics to the mailing
list. The discussion following them give a good reference for