Skip to content

Commit bca5f51

Browse files
authored
Link to the Swift.org security policy (#21)
### Motivation This project currently falls under the Swift.org security policy, not the SSWG. ### Modifications Update the SECURITY.md file to point to the Swift.org common security policy. ### Result The security file points to the common security policy. ### Test Plan No functional change. CI continues to pass.
1 parent fc50ff7 commit bca5f51

File tree

1 file changed

+2
-42
lines changed

1 file changed

+2
-42
lines changed

SECURITY.md

Lines changed: 2 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,3 @@
1-
# Security
1+
# Swift Security Process
22

3-
This document specifies the security process for the SwiftContainerPlugin project.
4-
5-
## Disclosures
6-
7-
### Private Disclosure Process
8-
9-
The SwiftContainerPlugin team asks that known and suspected vulnerabilities be privately
10-
and responsibly disclosed by emailing [[email protected]](mailto:[email protected])
11-
with the details usually included with bug reports.
12-
**Do not file a public issue.**
13-
14-
#### When to report a vulnerability
15-
16-
* You think you have discovered a potential security vulnerability in SwiftContainerPlugin or any of the SwiftContainerPlugin projects.
17-
* You are unsure how a vulnerability affects SwiftContainerPlugin or any of the SwiftContainerPlugin projects.
18-
19-
#### What happens next?
20-
21-
* A member of the team will acknowledge receipt of the report within 3
22-
working days (United States). This may include a request for additional
23-
information about reproducing the vulnerability.
24-
* We will privately inform the Swift Server Work Group ([SSWG][sswg]) of the
25-
vulnerability within 10 days of the report as per their [security
26-
guidelines][sswg-security].
27-
* Once we have identified a fix we may ask you to validate it. We aim to do this
28-
within 30 days. In some cases this may not be possible, for example when the
29-
vulnerability exists at the protocol level and the industry must coordinate on
30-
the disclosure process.
31-
* If a CVE number is required, one will be requested from [MITRE][mitre]
32-
providing you with full credit for the discovery.
33-
* We will decide on a planned release date and let you know when it is.
34-
* Prior to release, we will inform major dependents that a security-related
35-
patch is impending.
36-
* Once the fix has been released we will publish a security advisory on GitHub
37-
and the [SSWG][sswg] will announce the vulnerability on the [Swift
38-
forums][swift-forums-sec].
39-
40-
[sswg]: https://github.com/swift-server/sswg
41-
[sswg-security]: https://github.com/swift-server/sswg/blob/main/process/incubation.md#security-best-practices
42-
[swift-forums-sec]: https://forums.swift.org/c/server/security-updates/
43-
[mitre]: https://cveform.mitre.org/
3+
Please see our main process guide on [Swift.org](https://www.swift.org/support/security.html)

0 commit comments

Comments
 (0)