Skip to content

chore: update SECURITY.md from global .github repo Signed-off-by: microcks-bot <info@microcks.io> #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yada merged 1 commit into from
Sep 8, 2026
+22 −6
Merged

chore: update SECURITY.md from global .github repo Signed-off-by: microcks-bot <info@microcks.io> #37

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 22 additions & 6 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,21 +2,37 @@

## Reporting a Vulnerability

If you've found a vulnerability in our components or website or want additional information regarding how we manage security, please report it via a [GitHub discussion](https://github.com/microcks/microcks/discussions).
Please do not report suspected vulnerabilities through public GitHub issues, discussions, pull requests or other public channels.

If you do not want to publicly report a security issue for one of the libraries owned by the Microcks community, write an email with a detailed description of the issue to security@microcks.io.
Report a vulnerability affecting any Microcks component or website privately by emailing the Microcks Security Team at [security@microcks.io](mailto:security@microcks.io).

## Public Disclosure Timing
Include as much of the following information as possible:

We prefer to fully disclose the bug as soon as possible once a user mitigation is available. The Fix Lead drives the schedule using their best judgment based on severity, development time, and release manager feedback. If the Fix Lead deals with public disclosure, all timelines will be set as soon as possible (ASAP).
- The affected component, repository and version,
- A description of the vulnerability and its potential impact,
- Detailed steps to reproduce the issue or a proof of concept,
- Any known mitigations or suggested remediation,
- Whether the vulnerability has already been disclosed or shared elsewhere.

The Security Team will acknowledge receipt within five business days. We may contact you for additional information while we validate the report, determine its severity and affected versions, and develop a remediation. Please keep the report confidential until a coordinated disclosure date has been agreed upon.

## Coordinated Disclosure

Microcks targets coordinated public disclosure within 90 calendar days of receiving a vulnerability report. When a fix or effective mitigation is available earlier, the Security Team may coordinate an earlier disclosure with the reporter.

The timeline may be extended when remediation is unusually complex, upstream or downstream coordination is required, or an earlier disclosure would create additional risk for users. The Security Team will notify the reporter of material timeline changes and agree on a revised disclosure date.

When appropriate, the Security Team will publish a GitHub Security Advisory that identifies affected and fixed versions, available mitigations, severity, credits and a CVE identifier. Disclosure occurs only after the fix or mitigation and the advisory are ready, unless active exploitation or another exceptional circumstance requires a different response.

## Supported Versions

Microcks releases follow the [semver](https://semver.org/) specification. Security fixes are typically merged into the current development branch and are due for release in the next minor version. We may create a fix release upon request or, if deemed necessary, as part of a critical security fix.
Microcks releases follow the [Semantic Versioning](https://semver.org/) specification. Security fixes are applied to the current development branch and may be backported to actively maintained release branches based on severity, impact and feasibility. Each published security advisory identifies the affected and fixed versions and any available mitigations.

## Security Team

The security team is made up of a subset of the project [maintainers](https://github.com/microcks/.github/blob/main/GOVERNANCE.md#maintainers-code-owners-contributors-and-adopters) and [code owners](https://github.com/microcks/.github/blob/main/GOVERNANCE.md#maintainers-code-owners-contributors-and-adopters) who are willing and able to respond to vulnerability reports.
The Security Team is made up of a subset of the project [Maintainers](https://github.com/microcks/.github/blob/main/GOVERNANCE.md#maintainers-code-owners-contributors-and-adopters) and [Code Owners](https://github.com/microcks/.github/blob/main/GOVERNANCE.md#maintainers-code-owners-contributors-and-adopters) who are willing and able to respond to vulnerability reports.

The Security Team is responsible for acknowledging and triaging reports, coordinating remediation, identifying a Fix Lead when needed, communicating with reporters, preparing advisories and coordinating disclosure. Information about an undisclosed vulnerability is shared only with people who need it to investigate, remediate or coordinate the disclosure.

## Credits

Expand Down
Loading