SECURITY.md #169
SECURITY.md #169
Conversation
aryanguptacsvtu
requested review from
Devasy and
vrajpatelll
as code owners
WalkthroughAdds a new Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Reporter
participant Maintainer
participant Repo as Repository
participant Release as Release Process
Note over Reporter,Maintainer: Vulnerability reporting workflow (coordinated disclosure)
Reporter->>Maintainer: Email vulnerability report (description, repro, impact, mitigations)
activate Maintainer
Maintainer-->>Reporter: Acknowledge receipt (target: 72 hours)
Maintainer->>Maintainer: Triage, verify, assess severity
Maintainer->>Repo: Prepare fix in private/secure branch
Repo-->>Maintainer: Fix validated and merged to main/release branches
Maintainer->>Release: Publish release notes / security advisory
Release-->>Reporter: Notify on fix availability
deactivate Maintainer
Note over Reporter,Release: Public disclosure occurs after fix is released
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (7)
SECURITY.md (7)
1-1: Fix title typo (“Polspliticy” → “Security Policy”).-# 🔒 Security Polspliticy +# 🔒 Security Policy
11-15: Clarify supported versions (be explicit).Vague “Latest/Older” makes backport expectations unclear. Propose explicit policy.
-| Version | Supported | -|---------|--------------------| -| Latest | ✅ Yes | -| Older | ❌ No | +| Version/Branch | Security fixes | +|----------------------------|----------------| +| main (latest) | ✅ Yes | +| Latest minor release (LTS) | ✅ Yes (90 days from release) | +| Older | ❌ No | + +Notes: +- We backport critical fixes to the latest minor for 90 days after release. +- After 90 days, only main receives fixes.
31-31: Fix punctuation.Double period after “72 hours”.
-⌛ We aim to respond to security reports **within 72 hours**.. +⌛ We aim to respond to security reports **within 72 hours**.
35-41: Add Safe Harbor language for good‑faith research.Protect researchers acting within bounds to reduce legal ambiguity.
## 🚫 Responsible Disclosure Guidelines @@ - Do not publicly disclose the issue until it has been resolved. - Avoid testing vulnerabilities in a way that could disrupt services. - Act in good faith and with respect for user data and privacy. + +### Safe Harbor +If you make a good‑faith effort to comply with this policy, we will not pursue or support legal action against you for your research. This includes: +- Testing only on your own accounts/data (no data exfiltration). +- No privacy violations, service degradation, or denial of service. +- Ceasing testing and notifying us immediately upon accessing sensitive data.
46-48: Define disclosure timelines.State when details can be published if no fix ships.
- We follow a **coordinated disclosure** approach. - We appreciate responsible reporting and will publicly disclose the issue only **after a fix has been released**. +- If a fix is not available within 90 days of triage (or an agreed extension), you may disclose limited technical details sufficient to protect users.
50-53: Mention CVE/GHSA handling and severity/triage targets.Improves expectations for reporters and users.
Security fixes will be merged into `main` and any supported release branches. We will publish release notes describing the fix and migration steps when required. + +### Triage & Severity +- We classify reports using CVSS and prioritize P0 (critical) through P3 (low). +- Initial triage target: 72h. Status updates at least weekly until resolved. + +### CVE/GHSA +- We disclose via GitHub Security Advisories (GHSA) and request CVE IDs when applicable.
62-66: Optionally add PGP key and link to reporting entry point.Provide encryption for sensitive reports and a direct pointer to the Security tab.
## 🔒 Resources @@ - [OWASP Top 10](https://owasp.org/www-project-top-ten/) + - PGP public key for [email protected]: (fingerprint and key block here) + - How to report a vulnerability on GitHub (Private Reporting): Security tab → “Report a vulnerability”Replace placeholders before merge.
|
Hi @Devasy23 , |
|
Hii @Devasy23 , Could you please add |
2 participants
Hi @Devasy23 ,
I've added the
SECURITY.mdfile as per the structure suggested in the issue.Please let me know if any changes are needed.😊
Summary by CodeRabbit