From 010ef9427d3c82ba637f090b3c7d300e394d3378 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Wed, 18 Jan 2023 22:15:18 +0100 Subject: [PATCH] docs: add security policy (#93) --- SECURITY.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..ef435649 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,30 @@ +# Security Policy + +## Supported Versions + +This project practices [trunk-based development](https://trunkbaseddevelopment.com/), +so only the most recent release will be supported with security updates. + +## Reporting a Vulnerability + +If you believe you have found a security vulnerability in this project, +please report it to us through coordinated disclosure. + +Please do not report security vulnerabilities through public GitHub issues, +discussions, or pull requests. + +Instead, please send an email to opensource[@]statnett.no. + +Please include as much of the information listed below as you can to help us +better understand and resolve the issue: + +- The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) +- Full paths of source file(s) related to the manifestation of the issue +- The location of the affected source code (tag/branch/commit or direct URL) +- Any special configuration required to reproduce the issue +- Step-by-step instructions to reproduce the issue +- Proof-of-concept or exploit code (if possible) +- Impact of the issue, including how an attacker might exploit the issue +- This information will help us triage your report more quickly. + +This information will help us triage your report more quickly.