From 4ba34e2cbc91ff8944b62f310060794237450aa8 Mon Sep 17 00:00:00 2001 From: Christian Krakau-Louis Date: Tue, 1 Apr 2025 05:45:18 +0200 Subject: [PATCH] feat: add SECURITY.md to outline security practices and guidelines --- SECURITY.md | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..208f3bff --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,57 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| 0.3.x | :white_check_mark: | +| 0.2.x | :white_check_mark: | +| < 0.2 | :x: | + +Each version will be supported for six months after release or until a new release has been made, whichever is longer. + +## Reporting a Vulnerability + +We take the security of our document-processor seriously. If you believe you've found a security vulnerability, please follow these steps: + +### How to Report + +1. **Do NOT disclose the vulnerability publicly** until it has been addressed by our team. +2. Email your findings to [security@christianlouis.de](mailto:security@christianlouis.de). Encrypt your message if it contains sensitive details. +3. Include as much information as possible: + - Type of vulnerability + - Full paths of source files related to the vulnerability + - Step-by-step instructions to reproduce the issue + - Proof of concept code, if possible + - Impact of the vulnerability + +### What to Expect + +- A confirmation email within 48 hours acknowledging your report. +- An assessment and validation of the reported vulnerability within 1 week. +- Regular updates about the progress of addressing the vulnerability. +- Credit for discovering and reporting the vulnerability (if desired). + +### Disclosure Policy + +- Please allow us reasonable time to resolve the issue before making any public disclosures. +- We aim to address confirmed vulnerabilities within 30-90 days, depending on complexity. +- Once the vulnerability is fixed, we'll publish a security advisory with details and credit. + +## Security Best Practices + +When using document-processor: +- Keep your installation up-to-date with the latest security patches +- Use strong access controls and authentication mechanisms +- Validate all inputs from untrusted sources +- Follow the principle of least privilege when configuring permissions + +## Security Updates + +Security updates will be released as part of our regular versioning process. Critical security fixes may be released as out-of-band updates. + +## Acknowledgments + +We'd like to thank the following individuals for responsibly reporting security issues: + +*This list will be updated as contributions are received.*