Christian Krakau-Louis
59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 0.4.x | :white_check_mark: |
|
|
| 0.3.x | :white_check_mark: |
|
|
| 0.2.x | :white_check_mark: |
|
|
| < 0.2 | :x: |
|
|
|
|
Each version will be supported for six months after release or until a new release has been made, whichever is longer.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We take the security of our document-processor seriously. If you believe you've found a security vulnerability, please follow these steps:
|
|
|
|
### How to Report
|
|
|
|
1. **Do NOT disclose the vulnerability publicly** until it has been addressed by our team.
|
|
2. Email your findings to [security@christianlouis.de](mailto:security@christianlouis.de). Encrypt your message if it contains sensitive details.
|
|
3. Include as much information as possible:
|
|
- Type of vulnerability
|
|
- Full paths of source files related to the vulnerability
|
|
- Step-by-step instructions to reproduce the issue
|
|
- Proof of concept code, if possible
|
|
- Impact of the vulnerability
|
|
|
|
### What to Expect
|
|
|
|
- A confirmation email within 48 hours acknowledging your report.
|
|
- An assessment and validation of the reported vulnerability within 1 week.
|
|
- Regular updates about the progress of addressing the vulnerability.
|
|
- Credit for discovering and reporting the vulnerability (if desired).
|
|
|
|
### Disclosure Policy
|
|
|
|
- Please allow us reasonable time to resolve the issue before making any public disclosures.
|
|
- We aim to address confirmed vulnerabilities within 30-90 days, depending on complexity.
|
|
- Once the vulnerability is fixed, we'll publish a security advisory with details and credit.
|
|
|
|
## Security Best Practices
|
|
|
|
When using document-processor:
|
|
- Keep your installation up-to-date with the latest security patches
|
|
- Use strong access controls and authentication mechanisms
|
|
- Validate all inputs from untrusted sources
|
|
- Follow the principle of least privilege when configuring permissions
|
|
|
|
## Security Updates
|
|
|
|
Security updates will be released as part of our regular versioning process. Critical security fixes may be released as out-of-band updates.
|
|
|
|
## Acknowledgments
|
|
|
|
We'd like to thank the following individuals for responsibly reporting security issues:
|
|
|
|
*This list will be updated as contributions are received.*
|