Hi all, According to the Apache guidance on documenting a security model:
https://cwiki.apache.org/confluence/spaces/SECURITY/pages/308153000/Documenting+your+security+model Adding a SECURITY.md file is recommended to guide users on how to report security issues. It is also useful for developers to explain why certain reported security issues are not considered vulnerabilities. For example, if SECURITY.md states that rule definitions are trusted input, we would not treat the ability to write malicious code in a rule as a vulnerability. I filed a PR: https://github.com/apache/incubator-kie/pull/7118 Does this look good to you? I tried to keep it concise, but we can add more statements if needed. Feel free to comment on the PR. Cheers, Toshiya --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
