diff options
| author | Joe Chen <jc@unknwon.io> | 2022-03-11 14:25:09 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-11 14:25:09 +0800 |
| commit | 82ee08908869e2cab56ce89f088d5a63b636d69a (patch) | |
| tree | 2ac42fdc91a13bff16e9d3be3ac1490b9f910f1f /SECURITY.md | |
| parent | 61529fd78024f107a0064b091d81cabed8d50cca (diff) | |
SECURITY: clarify vulnerability lifecycle (#6828)
[skip ci]
Diffstat (limited to 'SECURITY.md')
| -rw-r--r-- | SECURITY.md | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/SECURITY.md b/SECURITY.md index cd4e7609..6bfd9dc2 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,12 +2,22 @@ ## Supported versions -Only lastest two minor version releases are supported for accepting vulnerability reports and patching for fixes. +Only lastest two minor version releases are supported (>= 0.12) for accepting vulnerability reports and patching fixes. -## Reporting a vulnerability +Existing vulnerability reports are being tracked in [Gogs Vulnerability Reports](https://jcunknwon.notion.site/Gogs-Vulnerability-Reports-81d7df52e45c4f159274e46ba48ed1b9). -Please create a dummy issue with high-level description of the security vulnerability, then report details to [security@gogs.io](mailto:security@gogs.io) privately. +## Vulnerability lifecycle -We strongly enourage to use https://huntr.dev/ for submitting and managing status of vulnerability reports instead of emails. +1. Report a vulnerability: + - We strongly enourage to use https://huntr.dev/ for submitting and managing status of vulnerability reports. + - Alternatively, you may send vulnerability reports through emails to [security@gogs.io](mailto:security@gogs.io). +1. Create a [dummy issue](https://github.com/gogs/gogs/issues/6810) with high-level description of the security vulnerability for credibility and tracking purposes. +1. Project maintainers review the report and either: + - Ask clarifying questions + - Confirm or deny the vulnerability +1. Once the vulnerability is confirmed, the reporter may submit a patch or wait for project maintainers to patch. + - The latter is usually significantly slower. +1. Patch releases will be made for the supported versions. +1. Publish the original vulnerability report and a new [GitHub security advisory](https://github.com/gogs/gogs/security/advisories). Thank you! |