docs: initial security policy
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
This commit is contained in:
parent
0b9b588c96
commit
59fcab281e
24
.github/SECURITY.md
vendored
Normal file
24
.github/SECURITY.md
vendored
Normal file
@ -0,0 +1,24 @@
|
||||
# Security Policy
|
||||
|
||||
## Reporting a vulnerability
|
||||
|
||||
To report a vulnerability, send an email to [cncf-dex-maintainers@lists.cncf.io](mailto:cncf-dex-maintainers@lists.cncf.io)
|
||||
detailing the issue and steps to reproduce. The reporter(s) can expect a
|
||||
response within 48 hours acknowledging the issue was received. If a response is
|
||||
not received within 48 hours, please reach out to any maintainer directly
|
||||
to confirm receipt of the issue.
|
||||
|
||||
## Review Process
|
||||
|
||||
Once a maintainer has confirmed the relevance of the report, a draft security
|
||||
advisory will be created on Github. The draft advisory will be used to discuss
|
||||
the issue with maintainers, the reporter(s).
|
||||
If the reporter(s) wishes to participate in this discussion, then provide
|
||||
reporter Github username(s) to be invited to the discussion. If the reporter(s)
|
||||
does not wish to participate directly in the discussion, then the reporter(s)
|
||||
can request to be updated regularly via email.
|
||||
|
||||
If the vulnerability is accepted, a timeline for developing a patch, public
|
||||
disclosure, and patch release will be determined. The reporter(s) are expected
|
||||
to participate in the discussion of the timeline and abide by agreed upon dates
|
||||
for public disclosure.
|
Reference in New Issue
Block a user