From b127e6fb07d5f667012e2a090b8faac7cd37d8ab Mon Sep 17 00:00:00 2001
From: Zach Borboa <zachborboa@gmail.com>
Date: Wed, 12 Oct 2016 09:17:44 -0700
Subject: [PATCH] Add security section

---
 README.md   |  5 +++++
 SECURITY.md | 11 +++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/README.md b/README.md
index 9092251..6deb6d1 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,7 @@ PHP Curl Class is an object-oriented wrapper of the PHP cURL extension that make
 - [Requirements](#requirements)
 - [Quick Start and Examples](#quick-start-and-examples)
 - [Available Methods](#available-methods)
+- [Security](#security)
 - [Contribute](#contribute)
 
 ---
@@ -279,6 +280,10 @@ MultiCurl::unsetHeader($key)
 MultiCurl::verbose($on = true, $output = STDERR)
 ```
 
+### Security
+
+See [SECURITY.md](https://github.com/php-curl-class/php-curl-class/blob/master/SECURITY.md).
+
 ### Contribute
 1. Check for open issues or open a new issue to start a discussion around a bug or feature.
 1. Fork the repository on GitHub to start making your changes.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..61a5e98
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+### Security
+
+* Don't blindly accept arbitrary urls. Curl supports many protocols including `FILE`. The following would show the contents of `file:///etc/passwd`.
+
+```php
+// https://www.example.com/fetch_page.php?url=file%3A%2F%2F%2Fetc%2Fpasswd
+$unsafe_url = $_GET['url']; // DANGER!
+$curl = new Curl();
+$curl->get($unsafe_url);
+echo $curl->response;
+```