PretendoNetwork/.profile
Watch
1
0
Fork
You've already forked .profile
 0
Code Issues Projects Releases Packages Wiki Activity

feat: added security policy

Browse source
This commit is contained in:
Jonathan Barrow 2024-05-15 11:36:43 -04:00
commit 1e2982d9ce
No known key found for this signature in database
GPG key ID: E86E9FE9049C741F
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
.github/SECURITY.md vendored Normal file
View file

@ -0,0 +1,13 @@
# Security Policy
## Supported Versions
All versions of our software are supported by this policy. However only the most recent version is supported for vulnerability reporting on its repository and is eligible for fixes and new releases. If a vulnerability is found in older versions of the software, a vulnerability report should instead be made on *dependant* software, so that an update may be issued.
## Reporting a Vulnerability
If a security vulnerability is discovered, we ask for a non-public disclosure. ***The repository "Issues" tracker is fully public.*** Security vulnerabilities can be privately disclosed on the repository's "Security" page (https://github.com/PretendoNetwork/NAME/security/advisories/new). Maintainers will be automatically notified and any non-notified, relevant, contributors will be made aware internally.
## Expectations and Communication
We understand the desire to publicly disclose security vulnerabilities following a non-public disclosure. We ask that you give us ample time to research the vulnerabilities, issue fixes, and update relevant software before this. Pretendo Network is maintained almost entirely on volunteer time, with a single full time developer. Thus communication may be slow, and we may need more than the typical amount of time to provide fixes.