From 1e2982d9ce015adcee51cc3ccb34c6695492b3af Mon Sep 17 00:00:00 2001 From: Jonathan Barrow Date: Wed, 15 May 2024 11:36:43 -0400 Subject: [PATCH] feat: added security policy --- .github/SECURITY.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/SECURITY.md diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 0000000..551c71e --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1,13 @@ +# Security Policy + +## Supported Versions + +All versions of our software are supported by this policy. However only the most recent version is supported for vulnerability reporting on its repository and is eligible for fixes and new releases. If a vulnerability is found in older versions of the software, a vulnerability report should instead be made on *dependant* software, so that an update may be issued. + +## Reporting a Vulnerability + +If a security vulnerability is discovered, we ask for a non-public disclosure. ***The repository "Issues" tracker is fully public.*** Security vulnerabilities can be privately disclosed on the repository's "Security" page (https://github.com/PretendoNetwork/NAME/security/advisories/new). Maintainers will be automatically notified and any non-notified, relevant, contributors will be made aware internally. + +## Expectations and Communication + +We understand the desire to publicly disclose security vulnerabilities following a non-public disclosure. We ask that you give us ample time to research the vulnerabilities, issue fixes, and update relevant software before this. Pretendo Network is maintained almost entirely on volunteer time, with a single full time developer. Thus communication may be slow, and we may need more than the typical amount of time to provide fixes. \ No newline at end of file