This is an automated email from the ASF dual-hosted git repository. zkaoudi pushed a commit to branch zkaoudi-patch-2 in repository https://gitbox.apache.org/repos/asf/wayang.git
commit f2eeedeeade7956834b8d4bf5c64826d37093719 Author: Zoi Kaoudi <[email protected]> AuthorDate: Tue Sep 1 13:24:40 2026 +0200 Copy security doc to code repo Updated security guidelines regarding the Wayang JSON REST API --- SECURITY.md | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..99ff2d8cb --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,41 @@ +# Wayang Security + +The Apache Software Foundation (ASF) and the Apache Wayang community take security very seriously. +Apache Wayang specifically provides robust security features and actively addresses concerns around potential vulnerabilities. +If you have discovered a vulnerability or have concerns regarding Apache Wayang security, please immediately contact the security team via email at +[[email protected]](mailto:[email protected]). + +In your email, please include: +- A detailed description of the security issue +- Steps to reproduce the vulnerability, if possible + +Upon receiving your report, our security team will review the provided information and respond accordingly. + +Please reserve the security address exclusively for reporting undisclosed vulnerabilities. For general security-related questions, usage of security features, or addressing known fixed issues, please utilize our user and developer mailing lists instead. Do not publicly disclose vulnerabilities without first reporting them to the Apache Wayang security team. + +The ASF Security team maintains detailed guidelines on managing and addressing vulnerabilities. For further information, please refer to the [ASF Security Page](https://www.apache.org/security/). + +## Advisories for Dependencies + +Many organizations employ security scanning tools to identify components with known security advisories. Although we strongly recommend these tools as they can alert users to potential risks, they often generate false positives. This occurs because a vulnerable dependency may not necessarily impact Apache Wayang if used in a non-exploitable manner. + +Therefore, advisories regarding Apache Wayang's dependencies are not automatically considered critical. However, if additional analysis indicates that Apache Wayang might be affected by a dependency's vulnerability, please report your findings privately to [[email protected]](mailto:[email protected]). + +If a dependency advisory is identified, please: + +1. Verify if our DependencyCheck suppressions contain relevant details. +2. Check our issue tracker for discussions regarding this advisory. +3. Conduct your own analysis to determine whether Apache Wayang is affected. + - If affected, report your findings privately through [[email protected]](mailto:[email protected]). + - If not affected, please contribute by updating the DependencyCheck suppression list, clearly documenting why Apache Wayang is not impacted. + +## Component-Specific Security Notes + +### Wayang JSON REST API + +The `wayang-api-json` module exposes a REST endpoint that accepts a WayangPlan in JSON format, including UDFs to be executed by the targeted engine. **This endpoint has no built-in authentication or authorization** — any client that can reach it can submit UDFs that will execute with the privileges of the Wayang process. + +This is a deliberate scope decision: the module is intended for use on a trusted network only (localhost, a private subnet, or behind a VPN). +**If the endpoint is exposed on a public IP, an authentication and encryption layer is recommended**. + +Questions on this are welcome at [[email protected]](mailto:[email protected]).
