SECURITY POLICY
THIS DOCUMENT DESCRIBES HOW TO REPORT SECURITY ISSUES, WHAT TO EXPECT, AND SAFE TESTING GUIDELINES FOR THE LINGO-STREAM REPOSITORY.
- REPORTING VULNERABILITIES
- PREFERRED: OPEN A PRIVATE SECURITY ADVISORY OR CONTACT VIA THE REPOSITORY'S GITHUB SECURITY CONTACT. IF PRIVATE ADVISORIES ARE NOT AVAILABLE, OPEN A GITHUB ISSUE MARKED "PRIVATE" OR SEND A DIRECT MESSAGE TO THE MAINTAINERS.
- INCLUDE: AFFECTED VERSION, STEPS TO REPRODUCE, IMPACT SUMMARY, AND SENSITIVE LOGS/PROOFS OF CONCEPT AS ATTACHMENTS OR IN A SECURE CHANNEL.
- SAFE DISCLOSURE PROCESS
- DO NOT PUBLICLY DISCLOSE VULNERABILITIES BEFORE COORDINATED FIXING AND A REASONABLE REMEDIATION PERIOD.
- MAINTAINERS WILL ACKNOWLEDGE RECEIPT WITHIN 72 HOURS AND PROVIDE AN INITIAL TRIAGE TIMELINE.
- CRITICAL VULNERABILITIES WILL BE PRIORITIZED; COORDINATED DISCLOSURE DEADLINES WILL BE AGREED WHERE PRACTICAL.
- SCOPE
- IN-SCOPE: REPO SOURCE CODE, BUILD SCRIPTS, EXTENSION RUNTIME LOGIC, AND SERVER-SIDE ASSETS OWNED BY THIS PROJECT.
- OUT-OF-SCOPE: THIRD-PARTY SERVICES, DEPENDENCY MAINTAINERS' INFRASTRUCTURE, AND END-USER SYSTEM MISCONFIGURATIONS NOT CAUSED BY PROJECT CODE.
- ALLOWED/PROHIBITED TESTING
- ALLOWED: NON-DESTRUCTIVE TESTING AGAINST LOCAL INSTANCES, STATIC ANALYSIS, AND PROOF-OF-CONCEPTS THAT DO NOT EXFILTRATE REAL USER DATA.
- PROHIBITED: ACTIVE EXPLOITS AGAINST PRODUCTION SYSTEMS, DATA EXFILTRATION, PRIVILEGE ESCALATION ON THIRD-PARTY HOSTS, OR DENIAL-OF-SERVICE ATTACKS.
- HANDLING OF SENSITIVE DATA
- DO NOT SHARE ANY PERSONAL DATA FROM USERS. PROVIDE REDACTED LOGS OR SANITIZED REPRODUCTIONS. MAINTAINERS WILL NOT ASK FOR PLAINTEXT SECRETS.
- FIXES, PATCHES, AND CVE
- MAINTAINERS MAY PUBLISH SECURITY FIXES VIA A RELEASE OR PATCH BRANCH. IF A CVE IS REQUIRED, MAINTAINERS WILL COORDINATE ASSIGNMENT AND DISCLOSURE.
- CREDIT AND BOUNTIES
- REPORTERS WHO HELP REMEDIATE OR PROVIDE QUALITY REPORTS MAY BE CREDITED IN RELEASE NOTES OR IN A CONTRIBUTORS LIST AT THE MAINTAINERS' DISCRETION. THIS PROJECT DOES NOT GUARANTEE MONETARY BOUNTIES.
- CONTACT
- START WITH A PRIVATE GITHUB SECURITY ADVISORY OR A PRIVATE ISSUE. IF THOSE OPTIONS ARE NOT AVAILABLE, OPEN A NORMAL GITHUB ISSUE MARKED WITH "SECURITY" BUT AVOID PUBLIC PROOFS.
THANK YOU FOR HELPING KEEP THIS PROJECT SECURE.