|
1 | 1 | # Security
|
2 | 2 |
|
3 |
| -This document specifies the security process for gRPC Swift. |
4 |
| - |
5 |
| -## Disclosures |
6 |
| - |
7 |
| -### Private Disclosure Process |
8 |
| - |
9 |
| -The gRPC Swift team asks that known and suspected vulnerabilities be |
10 |
| -privately and responsibly disclosed by emailing |
11 |
| - |
12 |
| -with the [details usually included with bug reports][issue-template]. |
13 |
| -**Do not file a public issue.** |
14 |
| - |
15 |
| -#### When to report a vulnerability |
16 |
| - |
17 |
| -* You think you have discovered a potential security vulnerability in gRPC |
18 |
| - Swift. |
19 |
| -* You are unsure how a vulnerability affects gRPC Swift. |
20 |
| - |
21 |
| -#### What happens next? |
22 |
| - |
23 |
| -* A member of the team will acknowledge receipt of the report within 3 |
24 |
| - working days (United Kingdom). This may include a request for additional |
25 |
| - information about reproducing the vulnerability. |
26 |
| -* We will privately inform the Swift Server Work Group ([SSWG][sswg]) of the |
27 |
| - vulnerability within 10 days of the report as per their [security |
28 |
| - guidelines][sswg-security]. |
29 |
| -* Once we have identified a fix we may ask you to validate it. We aim to do this |
30 |
| - within 30 days. In some cases this may not be possible, for example when the |
31 |
| - vulnerability exists at the protocol level and the industry must coordinate on |
32 |
| - the disclosure process. |
33 |
| -* If a CVE number is required, one will be requested from [MITRE][mitre] |
34 |
| - providing you with full credit for the discovery. |
35 |
| -* We will decide on a planned release date and let you know when it is. |
36 |
| -* Prior to release, we will inform major dependents that a security-related |
37 |
| - patch is impending. |
38 |
| -* Once the fix has been released we will publish a security advisory on GitHub |
39 |
| - and the [SSWG][sswg] will announce the vulnerability on the [Swift |
40 |
| - forums][swift-forums-sec]. |
41 |
| - |
42 |
| -[issue-template]: https://github.com/grpc/grpc-swift/blob/main/.github/ISSUE_TEMPLATE/BUG_REPORT.md |
43 |
| -[sswg]: https://github.com/swift-server/sswg |
44 |
| -[sswg-security]: https://github.com/swift-server/sswg/blob/main/process/incubation.md#security-best-practices |
45 |
| -[swift-forums-sec]: https://forums.swift.org/c/server/security-updates/ |
46 |
| -[mitre]: https://cveform.mitre.org/ |
| 3 | +Please refer to [SECURITY.md] in the |
| 4 | +[`grpc/grpc-swift`](https://github.com/grpc/grpc-swift) repository. |
0 commit comments