39 lines
1.5 KiB
Markdown
39 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
We release patches for security vulnerabilities. Which versions are eligible for
|
|
receiving such patches depends on the CVSS v3.0 Rating:
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| latest | :white_check_mark: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please report (suspected) security vulnerabilities to the maintainers privately.
|
|
You can do this by opening a [GitHub Security Advisory](https://github.com/vectorize-io/hindsight/security/advisories/new).
|
|
|
|
You will receive a response from us within 48 hours. If the issue is confirmed,
|
|
we will release a patch as soon as possible depending on complexity but
|
|
typically within a few days.
|
|
|
|
Please include the following information in your report:
|
|
|
|
- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
|
|
- Full paths of source file(s) related to the manifestation of the issue
|
|
- The location of the affected source code (tag/branch/commit or direct URL)
|
|
- Any special configuration required to reproduce the issue
|
|
- Step-by-step instructions to reproduce the issue
|
|
- Proof-of-concept or exploit code (if possible)
|
|
- Impact of the issue, including how an attacker might exploit the issue
|
|
|
|
This information will help us triage your report more quickly.
|
|
|
|
## Preferred Languages
|
|
|
|
We prefer all communications to be in English.
|
|
|
|
## Policy
|
|
|
|
We follow the principle of [Coordinated Vulnerability Disclosure](https://www.cisa.gov/resources-tools/programs/coordinated-vulnerability-disclosure-program).
|