From 95b78442514958c2f1fe747d43a5ae390bb029cf Mon Sep 17 00:00:00 2001 From: Michael Hobbs Date: Mon, 27 Jul 2026 23:24:30 -0400 Subject: [PATCH] Add a security policy Point vulnerability reports at GitHub's private reporting rather than the public issue tracker, and state that the hosted DICOM Standard Browser is in scope alongside this repository. The File Editor already directs its bug reports here, so the distinction was not obvious to reporters. Adding this file also makes GitHub surface a "Report a vulnerability" link in the issue chooser at /issues/new/choose. --- SECURITY.md | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..4913ced --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,31 @@ +# Security Policy + +## Reporting a vulnerability + +Please report security issues privately rather than in a public issue. + +Use GitHub's private vulnerability reporting: the **Report a vulnerability** button on +the [Security tab](https://github.com/innolitics/dicom-standard/security/advisories/new). +That opens a thread visible only to the maintainers and the reporter. + +Please don't test against the live site. If a proof of concept would change server state, +describe it rather than running it, or reproduce it locally. The published bundles ship +source maps, so the browser can be checked offline. + +## Scope + +This repository publishes the DICOM Standard as JSON, and that data backs the DICOM +Standard Browser at . Reports for either belong here: + +- **This repository**: the Python parsing code and the generated `standard/*.json`. +- **The hosted browser**, including the File Editor, which already sends its bug reports + to this tracker. + +Out of scope: values that are parsed faithfully from the Standard but look wrong. Those +are ordinary issues, and a defect in the Standard itself needs a Correction Proposal to +NEMA. + +## What to include + +Where the problem is, how to reproduce it, and what it would let someone do. A minimal +reproduction is more useful than a long report.