|
1 | 1 | # Security |
2 | 2 |
|
3 | | -This document specifies the security process for gRPC Swift. |
4 | | - |
5 | | -## Disclosures |
6 | | - |
7 | | -### Private Disclosure Process |
8 | | - |
9 | | -The gRPC Swift team asks that known and suspected vulnerabilities be |
10 | | -privately and responsibly disclosed by emailing |
11 | | - |
12 | | -with the [details usually included with bug reports][issue-template]. |
13 | | -**Do not file a public issue.** |
14 | | - |
15 | | -#### When to report a vulnerability |
16 | | - |
17 | | -* You think you have discovered a potential security vulnerability in gRPC |
18 | | - Swift. |
19 | | -* You are unsure how a vulnerability affects gRPC Swift. |
20 | | - |
21 | | -#### What happens next? |
22 | | - |
23 | | -* A member of the team will acknowledge receipt of the report within 3 |
24 | | - working days (United Kingdom). This may include a request for additional |
25 | | - information about reproducing the vulnerability. |
26 | | -* We will privately inform the Swift Server Work Group ([SSWG][sswg]) of the |
27 | | - vulnerability within 10 days of the report as per their [security |
28 | | - guidelines][sswg-security]. |
29 | | -* Once we have identified a fix we may ask you to validate it. We aim to do this |
30 | | - within 30 days. In some cases this may not be possible, for example when the |
31 | | - vulnerability exists at the protocol level and the industry must coordinate on |
32 | | - the disclosure process. |
33 | | -* If a CVE number is required, one will be requested from [MITRE][mitre] |
34 | | - providing you with full credit for the discovery. |
35 | | -* We will decide on a planned release date and let you know when it is. |
36 | | -* Prior to release, we will inform major dependents that a security-related |
37 | | - patch is impending. |
38 | | -* Once the fix has been released we will publish a security advisory on GitHub |
39 | | - and the [SSWG][sswg] will announce the vulnerability on the [Swift |
40 | | - forums][swift-forums-sec]. |
41 | | - |
42 | | -[issue-template]: https://github.com/grpc/grpc-swift/blob/main/.github/ISSUE_TEMPLATE/BUG_REPORT.md |
43 | | -[sswg]: https://github.com/swift-server/sswg |
44 | | -[sswg-security]: https://github.com/swift-server/sswg/blob/main/process/incubation.md#security-best-practices |
45 | | -[swift-forums-sec]: https://forums.swift.org/c/server/security-updates/ |
46 | | -[mitre]: https://cveform.mitre.org/ |
| 3 | +Please refer to [SECURITY.md] in the |
| 4 | +[`grpc/grpc-swift`](https://github.com/grpc/grpc-swift) repository. |
0 commit comments