From 68b90a190e5ede7c142ee508c22f1a130254899e Mon Sep 17 00:00:00 2001 From: "James Cullum (Pseudonym)" Date: Sat, 30 Sep 2023 23:21:42 +0300 Subject: [PATCH] Create SECURITY.md Create SECURITY.md based on the Microsoft best practice --- SECURITY.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..2a5b7946 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,35 @@ +## Security + +We take the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations. + +If you believe you have found a security vulnerability in any of our repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/security.md/definition), please report it to us as described below. + +## Reporting Security Issues + +**Please do not report security vulnerabilities through public GitHub issues.** + +Instead, please report them to us using private vulnerability reporting (see [here](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)). + +If you prefer to submit via direct communication, you can send an email to [the lead maintainer](https://mailhide.io/en/e/Wno7k). + +You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message. + +Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue: + + * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) + * Full paths of source file(s) related to the manifestation of the issue + * The location of the affected source code (tag/branch/commit or direct URL) + * Any special configuration required to reproduce the issue + * Step-by-step instructions to reproduce the issue + * Proof-of-concept or exploit code (if possible) + * Impact of the issue, including how an attacker might exploit the issue + +This information will help us triage your report more quickly. + +## Preferred Languages + +We prefer all communications to be in English. + +## Policy + +We follow the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/security.md/cvd).