|
3 | 3 | Security policy
|
4 | 4 | ===============
|
5 | 5 |
|
6 |
| -The development team is strongly committed to responsible reporting and |
7 |
| -disclosure of security-related issues. As such, we’ve adopted and follow a set |
8 |
| -of policies which conform to that ideal and are geared toward allowing us to |
| 6 | +The development team is strongly committed to responsible reporting and |
| 7 | +disclosure of security-related issues. As such, we’ve adopted and follow a set |
| 8 | +of policies which conform to that ideal and are geared toward allowing us to |
9 | 9 | deliver timely security updates to the official distribution of Open Inwoner.
|
10 | 10 |
|
11 | 11 | Reporting security issues
|
12 | 12 | -------------------------
|
13 | 13 |
|
14 |
| -**Short version: please report security issues by emailing |
| 14 | +**Short version: please report security issues by emailing |
15 | 15 |
|
16 | 16 |
|
17 |
| -If you discover security issues in Open Inwoner or related projects under the |
18 |
| -same organization, we request you to disclose these in a *responsible* way by |
| 17 | +If you discover security issues in Open Inwoner or related projects under the |
| 18 | +same organization, we request you to disclose these in a *responsible* way by |
19 | 19 |
|
20 | 20 |
|
21 |
| -It is extremely useful if you have a reproducible test case and/or clear steps |
| 21 | +It is extremely useful if you have a reproducible test case and/or clear steps |
22 | 22 | on how to reproduce the vulnerability.
|
23 | 23 |
|
24 |
| -Please do not report security issues on the public Github issue tracker, as |
25 |
| -this makes it visible which exploits exist before a fix is available, |
| 24 | +Please do not report security issues on the public Github issue tracker, as |
| 25 | +this makes it visible which exploits exist before a fix is available, |
26 | 26 | potentially comprising a lot of unprotected instances.
|
27 | 27 |
|
28 |
| -Once you’ve submitted an issue via email, you should receive an acknowledgment |
29 |
| -from a member of the security team as soon as possible, and depending on the |
| 28 | +Once you’ve submitted an issue via email, you should receive an acknowledgment |
| 29 | +from a member of the security team as soon as possible, and depending on the |
30 | 30 | action to be taken, you may receive further followup emails.
|
31 | 31 |
|
32 | 32 | Timeline of the process
|
33 | 33 | -----------------------
|
34 | 34 |
|
35 |
| -Open Inwoner community support is provided by `Maykin Media`_. The community |
| 35 | +Open Inwoner community support is provided by `Maykin Media`_. The community |
36 | 36 | support team is responsible for the handling of security issues.
|
37 | 37 |
|
38 |
| -1. The recipients of the report first validate if there is indeed a (possible) |
| 38 | +1. The recipients of the report first validate if there is indeed a (possible) |
39 | 39 | issue.
|
40 | 40 |
|
41 | 41 | 2. After validation, we confirm that we received the report and if it is indeed
|
42 | 42 | a valid issue.
|
43 | 43 |
|
44 |
| -3. We have a private Github repository accessible only to the community support |
45 |
| - team. In this repository, an issue is created for the vulnerability where |
| 44 | +3. We have a private Github repository accessible only to the community support |
| 45 | + team. In this repository, an issue is created for the vulnerability where |
46 | 46 | the impact and possible solutions are discussed.
|
47 | 47 |
|
48 |
| -4. The next step is to create a (draft) Github security advisory, which is only |
49 |
| - visible to the repository administrators and community support team. |
| 48 | +4. The next step is to create a (draft) Github security advisory, which is only |
| 49 | + visible to the repository administrators and community support team. |
50 | 50 | Severity and impact will be established here.
|
51 | 51 |
|
52 | 52 | 5. If appropriate, we request a `CVE identifier`_ from Github.
|
53 | 53 |
|
54 | 54 | 6. A patch is implemented, reviewed and tested in a private fork.
|
55 | 55 |
|
56 |
| -7. When the fix is tested and release coordination is done, the fix is merged |
57 |
| - into the primary repository. The security advisory and release are |
| 56 | +7. When the fix is tested and release coordination is done, the fix is merged |
| 57 | + into the primary repository. The security advisory and release are |
58 | 58 | published. All managed instances should be updated.
|
59 | 59 |
|
60 |
| -8. The release and security vulnerability are communicated to the community. |
| 60 | +8. The release and security vulnerability are communicated to the community. |
61 | 61 | This includes an announcement on `commonground.nl`_.
|
62 | 62 |
|
63 | 63 |
|
|
0 commit comments