hubcio commented on code in PR #3787: URL: https://github.com/apache/iggy/pull/3787#discussion_r3702127838
########## SECURITY.md: ########## @@ -0,0 +1,62 @@ +# Security Policy + +Apache Iggy (Incubating) follows the [Apache Software Foundation security process](https://www.apache.org/security/). +Please read this before reporting anything you believe is a security issue. + +## Reporting a Vulnerability + +**Do not report security vulnerabilities through public channels.** That means no GitHub issues, pull +requests or discussions, no Discord, and no social media. Public disclosure before a fix is available +puts users at risk. + +Send reports to **[[email protected]](mailto:[email protected])**. + +Iggy does not currently have its own project security list, so `[email protected]` is the correct +address. The ASF Security Team will forward your report to the Iggy PPMC's private list and confirm to +you that they have done so. + +When reporting, please: + +- send one plain-text, unencrypted email per vulnerability +- describe the issue in the body rather than attaching images, video, HTML or PDF +- include the affected version or commit, the component (server, SDK and language, CLI, connector, + MCP server, web UI), the transport in use where relevant, and the configuration required to hit it +- include reproduction steps and your assessment of the impact + +## What Happens Next + +1. The ASF Security Team acknowledges receipt and forwards the report to the Iggy PPMC. +2. We acknowledge the report and investigate. We will tell you whether we accept or reject it, and why. +3. If accepted, a CVE ID is allocated. The ASF Security Team is the CNA for all Apache projects and is + the only body that can assign CVE IDs to Apache software. +4. We develop the fix in private. There will be no public issue, and the commit message will not + indicate that the change is security related. +5. The fix ships in a release. The advisory is published at or after the release announcement and is + sent to the reporter, the project's announcement destinations, the ASF Security Team, and + [oss-security](https://www.openwall.com/lists/oss-security/). + +We will share the draft advisory with you before publication and credit you unless you prefer +otherwise. Please keep the report confidential until the announcement. + +## Out of Scope + +The following are not treated as vulnerabilities in Apache Iggy: + +- automated scanner or dependency-checker output with no demonstrated exploit against a supported Review Comment: q: "supported configuration" is undefined - the doc has no supported-versions statement. Intentional (avoids asserting policy on the project's behalf), or should it say "only the latest apache release is supported"? If left undefined, consider dropping the word "supported". -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
