Skip to content

Commit 410cc4a

Browse files
alex-semenyukalex-semenyuk
authored
Fix SECURITY.md
Signed-off-by: alexey semenyuk <alexsemenyuk88@gmail.com>
1 parent ad7e659 commit 410cc4a

File tree

1 file changed

+161
-6
lines changed

1 file changed

+161
-6
lines changed

‎SECURITY.md‎

Lines changed: 161 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,166 @@
1-
# Hyperledger Security Policy
1+
# Hyperledger Firefly, an LF Decentralized Trust Project Security Policy
22

3-
## Reporting a Security Bug
3+
[LF Decentralized Trust Security Policy]: https://lf-decentralized-trust.github.io/governance/governing-documents/security
44

5-
If you think you have discovered a security issue in any of the Hyperledger projects, we'd love to hear from you. We will take all security bugs seriously and if confirmed upon investigation we will patch it within a reasonable amount of time and release a public security bulletin discussing the impact and credit the discoverer.
5+
## About this document
66

7-
There are two ways to report a security bug. The easiest is to email a description of the flaw and any related information (e.g. reproduction steps, version) to [security at hyperledger dot org](mailto:security@hyperledger.org).
7+
This document defines how security vulnerability reporting is handled in Hyperledger Firefly, an LF Decentralized Trust Project.
8+
The approach aligns with the [LF Decentralized Trust Security Policy] . Please
9+
review that document to understand the basis of the security reporting for Hyperledger Firefly.
810

9-
The other way is to file a confidential security bug in the repository's [security advisories page](https://github.com/hyperledger/firefly/security/advisories). Guidance can be found in the GitHub documentation on [privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).
11+
This vulnerability policy borrows heavily from the
12+
recommendations of the OpenSSF Vulnerability Disclosure working group. For
13+
up-to-date information on the latest recommendations related to vulnerability
14+
disclosures, please visit the [GitHub of that working
15+
group](https://github.com/ossf/wg-vulnerability-disclosures).
1016

11-
The process by which the Hyperledger Security Team handles security bugs is documented further in our [Defect Response page](https://lf-hyperledger.atlassian.net/wiki/spaces/SEC/pages/20283618/Defect+Response) on our [wiki](https://lf-hyperledger.atlassian.net/wiki).
17+
If you are already familiar with the security policies of Hyperledger Firefly, and
18+
ready to report a vulnerability, please jump to [Report Intakes](#report-intakes).
19+
20+
## Outline
21+
22+
This document has the following sections:
23+
24+
- [Hyperledger Firefly Security Policy](#project-an-lf-decentralized-trust-project-security-policy)
25+
- [Instructions](#instructions)
26+
- [About this document](#about-this-document)
27+
- [Outline](#outline)
28+
- [What Is a Vulnerability Disclosure Policy?](#what-is-a-vulnerability-disclosure-policy)
29+
- [Security Team](#security-team)
30+
- [Discussion Forums](#discussion-forums)
31+
- [Report Intakes](#report-intakes)
32+
- [CNA/CVE Reporting](#cnacve-reporting)
33+
- [Embargo List](#embargo-list)
34+
- [(GitHub) Security Advisories](#github-security-advisories)
35+
- [Private Patch Deployment Infrastructure](#private-patch-deployment-infrastructure)
36+
37+
## What Is a Vulnerability Disclosure Policy?
38+
39+
No piece of software is perfect. All software (at least, all software of a
40+
certain size and complexity) has bugs. In open source development, members of
41+
the community or the public find bugs and report them to the project. A
42+
vulnerability disclosure policy explains how this process functions from the
43+
perspective of the project.
44+
45+
This vulnerability disclosure policy explains the rules and guidelines for
46+
Hyperledger Firefly. It is intended to act as both a reference for
47+
outsiders–including both bug reporters and those looking for information on the
48+
project’s security practices–as well as a set of rules that maintainers and
49+
contributors have agreed to follow.
50+
51+
## Security Team
52+
53+
The current Hyperledger Firefly security team is:
54+
55+
| Name | Email ID | Discord ID | Area/Specialty |
56+
| ---------------- | ------------------ | ---------- | --------------- |
57+
58+
59+
The security team for Hyperledger Firefly must include at least three project
60+
Maintainers that agree to carry out the following duties and responsibilities.
61+
Members are added and removed from the team via approved Pull Requests to this
62+
repository. For additional background into the role of the security team, see
63+
the [People Infrastructure] section of the LF Decentralized Trust Security Policy.
64+
65+
[People Infrastructure]: https://lf-decentralized-trust.github.io/governance/governing-documents/security.html#people-infrastructure
66+
67+
**Responsibilities:**
68+
69+
1. Acknowledge the receipt of vulnerability reports to the reporter within 2
70+
business days.
71+
72+
2. Assess the issue. Engage with the reporter to ask any outstanding questions
73+
about the report and how to reproduce it. If the report was received by email
74+
and may be a security vulnerability, open a GitHub Security Advisory on the
75+
repository to manage the report. If the report is not considered a
76+
vulnerability, then the reporter should be informed and this process can be
77+
halted. If the report is a regular bug (but not a security vulnerability), the
78+
reporter should be informed (if necessary) of the regular process for reporting
79+
issues.
80+
81+
3. Some issues may require more time and resources to correct. If a particular
82+
report is complex, discuss an embargo period with the reporter during which
83+
time the report will not be publicly disclosed. The embargo period should be
84+
negotiated with the reporter and must not be longer than 90 days.
85+
86+
4. If necessary, create a private patch development infrastructure for the issue
87+
by emailing the [LF Decentralized Trust Community Architects].
88+
89+
[LF Decentralized Trust Community Architects]: mailto:community-architects@lfdecentralizedtrust.org
90+
91+
5. Request a CVE for the issue (see the [CNA/CVE Reporting](#cnacve-reporting)
92+
section).
93+
94+
6. Decide a date for the public release of the vulnerability report, the date
95+
the embargo period ends.
96+
97+
7. If applicable, notify members of the embargo list of the vulnerability,
98+
upcoming patch and release, as described above.
99+
100+
8. Publish a new (software) release in which the vulnerability is addressed.
101+
102+
9. Publicly disclose the issue within 48 hours after the release via a
103+
GitHub security advisory (see the [(GitHub) Security
104+
Advisories](#github-security-advisories) section for details).
105+
106+
## Discussion Forums
107+
108+
Discussions about each reported vulnerability should be carried out in the
109+
private GitHub security advisory about the vulnerability. If necessary, a private
110+
channel specific to the issue may be created on the LF Decentralized Trust Discord server
111+
with invited participants added to the discussion.
112+
113+
## Report Intakes
114+
115+
Hyperledger Firefly has the following ways to submit security
116+
vulnerabilities. While the security team members will do their best to
117+
respond to bugs disclosed in all possible ways, it is encouraged for bug
118+
finders to report through the following approved channels:
119+
120+
- Email the [LF Decentralized Trust Foundation security
121+
list](mailto:security@lists.lfdecentralizedtrust.org): To report a security issue, please
122+
send an email with the name of the project/repository, a description of the issue, the
123+
steps you took to create the issue, affected versions, and if known,
124+
mitigations. If in triaging the email, the security team determines the issue may be
125+
a security vulnerability, a [GitHub security vulnerability report] will be
126+
opened.
127+
- Open a [GitHub security vulnerability report]: Open a draft security advisory
128+
on the "Security" tab of this GitHub repository. See [GitHub Security
129+
Advisories](#github-security-advisories) to learn more about the security
130+
infrastructure in GitHub.
131+
132+
[GitHub security vulnerability report]: https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability
133+
134+
## CNA/CVE Reporting
135+
136+
Hyperledger Firefly maintains a list of **Common Vulnerabilities and Exposures
137+
(CVE)** and uses GitHub as its **CVE numbering authority (CNA)** for issuing
138+
CVEs.
139+
140+
## Embargo List
141+
142+
Hyperledger Firefly does **NOT** currently maintain a private embargo list.
143+
144+
If you wish to be added to the embargo list, please email the [LF Decentralized Trust Foundation security
145+
mailing list](mailto:security@lists.lfdecentralizedtrust.org), including the project name
146+
(Hyperledger Firefly) and reason for being added to the embargo list. Requests
147+
will be assessed by the Hyperledger Firefly security team in conjunction with the
148+
appropriate LF Decentralized Trust Staff, and a decision will be made to accommodate or not
149+
the request.
150+
151+
For more information about the embargo list, please see the [Embargo List
152+
section of the LF Decentralized Trust Security
153+
Policy](https://lf-decentralized-trust.github.io/governance/governing-documents/security.html#embargo-list).
154+
155+
## (GitHub) Security Advisories
156+
157+
Hyperledger Firefly uses GitHub Security Advisories to manage the public
158+
disclosure of security vulnerabilities.
159+
160+
## Private Patch Deployment Infrastructure
161+
162+
In creating patches and new releases that address security vulnerabilities,
163+
Hyperledger Firefly uses the private development features of GitHub for security
164+
vulnerabilities. GitHub has [extensive
165+
documentation](https://docs.github.com/en/code-security/security-advisories/repository-security-advisories)
166+
about these features.

0 commit comments

Comments
 (0)