From 6ce0d63733412a58f010cbc092c51a757ecb883c Mon Sep 17 00:00:00 2001 From: timedout Date: Tue, 21 Jul 2026 14:45:17 +0100 Subject: [PATCH] meta: Update expectations section and call out attribution --- SECURITY.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 798f4c5b4..b386a571f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -29,13 +29,15 @@ ensure that potential vulnerabilities are addressed properly, please follow thes - [@ginger:gingershaped.computer](https://matrix.to/#/@ginger:gingershaped.computer) 2. **Email the security team** at [security@continuwuity.org](mailto:security@continuwuity.org). This is not E2EE, so don't include sensitive details. -3. **Do not disclose the vulnerability publicly** until it has been addressed +3. **Do not disclose the vulnerability publicly** until a fix has been pushed to the main branch. 4. **Provide detailed information** about the vulnerability, including: - A clear description of the issue - Steps to reproduce - Potential impact - Any possible mitigations - Version(s) affected, including specific commits if possible + - How you want to be attributed if your report is accepted (website, social media handle, Matrix user ID, etc). + **Please state explicitly if you wish to remain anonymous.** If you have any doubts about a potential security vulnerability, contact us via private channels first! We'd prefer that you bother us, instead of having a vulnerability disclosed without a fix. @@ -74,14 +76,15 @@ Likewise, CVE farming (reporting vulnerabilities with the primary intent to get project, and will not be credited. Severe violations of this policy will result in a permanent ban from collaborating with the project in any capacity. We are attempting to build high quality free software, not flesh out your CV/resume. -### What to Expect +### What to expect When you report a security vulnerability: -1. **Acknowledgment**: We will acknowledge receipt of your report. -2. **Assessment**: We will assess the vulnerability and determine its impact on our users -3. **Updates**: We will provide updates on our progress in addressing the vulnerability, and may request you help test - mitigations +1. **Acknowledgment**: We will acknowledge receipt of your report. We may ask for further information. +2. **Triage**: The report will be triaged into our internal tracker, and you will be provided with a reference number ( + in case you end up with multiple reports). An ETA for a fix will be provided if feasible. +3. **Updates**: We will provide updates on our progress in addressing the vulnerability, including a heads-up for when + we plan to release a fix. 4. **Resolution**: Once resolved, we will notify you and discuss coordinated disclosure 5. **Credit**: We will recognize your contribution (unless you prefer to remain anonymous)