.

2026-05-23 06:45:43 +00:00 · 2025-10-21 23:45:13 +07:00
parent 6c387b420c
commit bb60e987e5
3548 changed files with 4952576 additions and 116 deletions
@@ -0,0 +1,41 @@
+### TL;DR
+
+We use a simplified version of [Golang Security Policy](https://go.dev/security).
+For example, for now we skip CVE assignment.
+
+### Reporting a Security Bug
+
+Please report to us any issues you find. This document explains how to do that and what to expect in return.
+
+All security bugs in our releases should be reported by email to erik@dubbelboer.com
+Your email will be acknowledged within 24 hours, and you'll receive a more detailed response
+to your email within 72 hours indicating the next steps in handling your report.
+Please use a descriptive subject line for your report email.
+
+### Flagging Existing Issues as Security-related
+
+If you believe that an existing issue is security-related, we ask that you send an email to erik@dubbelboer.com
+The email should include the issue ID and a short description of why it should be handled according to this security policy.
+
+### Disclosure Process
+
+Our project uses the following disclosure process:
+
+- Once the security report is received it is assigned a primary handler. This person coordinates the fix and release process.
+- The issue is confirmed and a list of affected software is determined.
+- Code is audited to find any potential similar problems.
+- Fixes are prepared for the two most recent major releases and the head/master revision. These fixes are not yet committed to the public repository.
+- To notify users, a new issue without security details is submitted to our GitHub repository.
+- Three working days following this notification, the fixes are applied to the public repository and a new release is issued.
+- On the date that the fixes are applied, announcement is published in the issue.
+
+This process can take some time, especially when coordination is required with maintainers of other projects.
+Every effort will be made to handle the bug in as timely a manner as possible, however it's important that we follow
+the process described above to ensure that disclosures are handled consistently.
+
+### Receiving Security Updates
+The best way to receive security announcements is to subscribe ("Watch") to our repository.
+Any GitHub issues pertaining to a security issue will be prefixed with [security].
+
+### Comments on This Policy
+If you have any suggestions to improve this policy, please send an email to erik@dubbelboer.com for discussion.