58819f6018
This patch adjust the SECURITY.md to follow a new workflow, which results in reports ending up on GitHub without going through my mailbox, this frees resources on my side as well as reducing the bus factor. Since most of the time, I do an editorial copy of the content of the E-Mail into GitHub's vulnerability template, this should help to reduce manual processes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2.3 KiB
Security Policy
Supported Versions
Only the latest release of HedgeDoc is supported. We don't have the ressources to maintain multiple versions.
Reporting a Vulnerability
Please go to "Issues" > "New" > "Report a security vulnerability". This allows you to get in direct, but private contact with us. There is some more detailed documentation available by GitHub.
Tip: In this form, only the title and description are mandatory [so don't worry if you can't fill everything]. […] However, we recommend security researchers provide as much information as possible on the form so that [we] can make an informed decision about the submitted report. You can adopt the template used by [GitHub's] security researchers from the GitHub Security Lab, which is available on the github/securitylab repository."
We'll get back to you as soon as possible. You can expect an answer within 3 days, in rare cases within a month. If you don't get a reply within a month, please reach out for other contact addresses in the community chat.
When your findings are accepted as a security issue, we'll work on a fix or at least a workaround for the next release. With the release that contained the fix, we want to encourage you to publish your findings as you like.
We'll also credit you in the release notes.
When your findings are not accepted as a security issue, feel free to write a fix yourself and contribute it to HedgeDoc, as well as publish them as you like and allow people to make an informed decision about using HedgeDoc.
If you have any further questions, feel free to reach out to the community chat or the mentioned contacts above.