artifacthub
/
hub
mirror of https://github.com/artifacthub/hub.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update the security process docs (#3128) 

The incubation requirements state, "Clearly documented security
processes explaining how to report security issues to the project,
and describing how the project provides updated releases or patches
to resolve security vulnerabilities"

This change updates the process to add more detail

Signed-off-by: Matt Farina <matt@mattfarina.com>
This commit is contained in:
Matt Farina 2023-06-20 13:05:46 -04:00 committed by GitHub
parent 3a748254b4
commit df155e3826
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
SECURITY.md
View File

@ -5,7 +5,17 @@
To report a security problem in Artifact Hub, please contact the Maintainers Team
at <cncf-artifacthub-maintainers@lists.cncf.io>.
The team will help diagnose the severity of the issue and determine how to
address the issue. Issues deemed to be non-critical will be filed as GitHub
issues. Critical issues will receive immediate attention and be fixed as quickly
as possible.
## Remediation and Notification Process
The maintainers will evaluate the report to verify the security issue. If the
issue does not have a security impact, the report and follow-up will move to
GitHub issues. If a security issue exists, the maintainers use the following
process:
1. Create a new draft advisory via GitHub Security Advisories
2. Request a CVE identification number
3. Collaborate on a private fork, part of the GitHub Security Advisory system,
to fix the issue.
4. Once a solution is ready, the CVE will be finalized and published, the change
will be merged, and there will be a new release of Artifact Hub including the
security fix.