|
1 | | -# Security |
| 1 | +# Swift Security Process |
2 | 2 |
|
3 | | -This document specifies the security process for the SwiftContainerPlugin project. |
4 | | - |
5 | | -## Disclosures |
6 | | - |
7 | | -### Private Disclosure Process |
8 | | - |
9 | | -The SwiftContainerPlugin team asks that known and suspected vulnerabilities be privately |
10 | | -and responsibly disclosed by emailing [[email protected]](mailto:[email protected]) |
11 | | -with the details usually included with bug reports. |
12 | | -**Do not file a public issue.** |
13 | | - |
14 | | -#### When to report a vulnerability |
15 | | - |
16 | | -* You think you have discovered a potential security vulnerability in SwiftContainerPlugin or any of the SwiftContainerPlugin projects. |
17 | | -* You are unsure how a vulnerability affects SwiftContainerPlugin or any of the SwiftContainerPlugin projects. |
18 | | - |
19 | | -#### What happens next? |
20 | | - |
21 | | -* A member of the team will acknowledge receipt of the report within 3 |
22 | | - working days (United States). This may include a request for additional |
23 | | - information about reproducing the vulnerability. |
24 | | -* We will privately inform the Swift Server Work Group ([SSWG][sswg]) of the |
25 | | - vulnerability within 10 days of the report as per their [security |
26 | | - guidelines][sswg-security]. |
27 | | -* Once we have identified a fix we may ask you to validate it. We aim to do this |
28 | | - within 30 days. In some cases this may not be possible, for example when the |
29 | | - vulnerability exists at the protocol level and the industry must coordinate on |
30 | | - the disclosure process. |
31 | | -* If a CVE number is required, one will be requested from [MITRE][mitre] |
32 | | - providing you with full credit for the discovery. |
33 | | -* We will decide on a planned release date and let you know when it is. |
34 | | -* Prior to release, we will inform major dependents that a security-related |
35 | | - patch is impending. |
36 | | -* Once the fix has been released we will publish a security advisory on GitHub |
37 | | - and the [SSWG][sswg] will announce the vulnerability on the [Swift |
38 | | - forums][swift-forums-sec]. |
39 | | - |
40 | | -[sswg]: https://github.com/swift-server/sswg |
41 | | -[sswg-security]: https://github.com/swift-server/sswg/blob/main/process/incubation.md#security-best-practices |
42 | | -[swift-forums-sec]: https://forums.swift.org/c/server/security-updates/ |
43 | | -[mitre]: https://cveform.mitre.org/ |
| 3 | +Please see our main process guide on [Swift.org](https://www.swift.org/support/security.html) |
0 commit comments