feat: add SECURITY.md to outline security practices and guidelines

2025-04-01 05:45:18 +02:00
parent bcda8e6d11
commit 4ba34e2cbc
1 changed files with 57 additions and 0 deletions
@@ -0,0 +1,57 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.3.x   | :white_check_mark: |
+| 0.2.x   | :white_check_mark: |
+| < 0.2   | :x:                |
+
+Each version will be supported for six months after release or until a new release has been made, whichever is longer.
+
+## Reporting a Vulnerability
+
+We take the security of our document-processor seriously. If you believe you've found a security vulnerability, please follow these steps:
+
+### How to Report
+
+1. **Do NOT disclose the vulnerability publicly** until it has been addressed by our team.
+2. Email your findings to [security@christianlouis.de](mailto:security@christianlouis.de). Encrypt your message if it contains sensitive details.
+3. Include as much information as possible:
+   - Type of vulnerability
+   - Full paths of source files related to the vulnerability
+   - Step-by-step instructions to reproduce the issue
+   - Proof of concept code, if possible
+   - Impact of the vulnerability
+
+### What to Expect
+
+- A confirmation email within 48 hours acknowledging your report.
+- An assessment and validation of the reported vulnerability within 1 week.
+- Regular updates about the progress of addressing the vulnerability.
+- Credit for discovering and reporting the vulnerability (if desired).
+
+### Disclosure Policy
+
+- Please allow us reasonable time to resolve the issue before making any public disclosures.
+- We aim to address confirmed vulnerabilities within 30-90 days, depending on complexity.
+- Once the vulnerability is fixed, we'll publish a security advisory with details and credit.
+
+## Security Best Practices
+
+When using document-processor:
+- Keep your installation up-to-date with the latest security patches
+- Use strong access controls and authentication mechanisms
+- Validate all inputs from untrusted sources
+- Follow the principle of least privilege when configuring permissions
+
+## Security Updates
+
+Security updates will be released as part of our regular versioning process. Critical security fixes may be released as out-of-band updates.
+
+## Acknowledgments
+
+We'd like to thank the following individuals for responsibly reporting security issues:
+
+*This list will be updated as contributions are received.*