Skip to content

chore(security): update overview #2562

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 25, 2024
Merged

chore(security): update overview #2562

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9e45667
chore(security): update overview
ntacheva Nov 22, 2024
e463fe0
Update security/overview.md
ntacheva Nov 25, 2024
c692987
Update security/overview.md
ntacheva Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion security/overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,14 +35,23 @@ We value the contributions of security researchers and ethical hackers. If a res
|------------------|------------------------|
| First Response | 7 days |
| Time to Triage | 10 days |
| Time to Resolution| Depends on severity |
| Time to Resolution| [Depends on severity](#vulnerability-remediation-guidelines) |

For more information, visit:

- [Bugcrowd Vulnerability Disclosure Program](https://bugcrowd.com/engagements/devtools-vdp)
- [Progress Trust Center](https://www.progress.com/trust-center)
- [Vulnerability Reporting Policy](https://www.progress.com/trust-center/vulnerability-reporting-policy)

## Vulnerability Remediation Guidelines

Progress follows defined timelines for remediating vulnerabilities based on their severity level, ensuring a structured and efficient approach to maintaining security across all products. These guidelines are aligned with the CVSS (Common Vulnerability Scoring System) scoring:

- **Critical score issues (CVSS 9.0+):** Resolved within **30 days**.
- **High score issues (CVSS 7.0–8.9):** Resolved within **60 days**.
- **Medium or lower score issues (CVSS < 7):** Resolved within **90–120 days**, depending on the score.

While these are not strict SLA (Service Level Agreement), they serve as a commitment to providing timely resolutions for identified vulnerabilities.

## What We Do to Mitigate Risk

Expand Down
Loading