From 9af19a9b744bc752afa53c78dafb7647bc16b5d1 Mon Sep 17 00:00:00 2001 From: Bill Zimmerman Date: Fri, 7 Apr 2023 21:50:29 +0200 Subject: [PATCH] Create SECURITY.md --- SECURITY.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..b37c905e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,27 @@ +# Security Policy + +The RaspAP team and community take all security vulnerabilities seriously. This document outlines security procedures and general policies for the RaspAP open source projects as found on https://github.com/RaspAP/. +If you believe you have found a security vulnerability in any RaspAP-owned repository, please report it to us as described below. + +## Reporting a vulnerability in RaspAP + +Thank you for improving the security of our open source software. +We appreciate your efforts and responsible disclosure, and will make every effort to acknowledge your contributions. + +Please report (suspected) security vulnerabilities to [security@raspap.com](mailto:security@raspap.com). The requested information listed below will help us better understand the nature and scope of the possible issue: + +1. Type of issue (eg. shell exploit, cross-site scripting, etc.) +2. Full paths of source file(s) related to the manifestation of the issue +3. The location of the affected source code (tag/branch/commit or direct URL) +4. Any special configuration required to reproduce the issue +5. Step-by-step instructions to reproduce the issue +6. Proof-of-concept or exploit code (if possible) +7. Impact of the issue, including how an attacker might exploit the issue + +This information will help us triage your report more quickly. + +You will receive a response from us within 48 hours. Developers may ask for additional information or clarity on your report. +If the issue is confirmed, we will release a patch as soon as possible depending on complexity, but historically within a few days. + +## Third-party modules +Report security vulnerabilities in third-party modules to the person or team maintaining the module.