From 5c826c8566c67b5c42b1af6c5d869588d394aea2 Mon Sep 17 00:00:00 2001 From: juanis2112 Date: Tue, 13 May 2025 17:09:28 -0700 Subject: [PATCH 1/3] Add spec about security policy --- spec-0015/index.md | 83 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 spec-0015/index.md diff --git a/spec-0015/index.md b/spec-0015/index.md new file mode 100644 index 00000000..e4c7efe4 --- /dev/null +++ b/spec-0015/index.md @@ -0,0 +1,83 @@ +--- +title: "SPEC 15 — Security Policy" +number: 15 +date: 2025-05-13 +author: + - "Juanita Gomez " + - "Mihai Maruseac " +is-draft: true +endorsed-by: +--- + +## Description + +A security policy in a GitHub repository helps users know how to report vulnerabilities responsibly and enables maintainers to respond effectively to security issues. This prevents senstive issues from being disclosed publicly before they are addressed. + +This spec provides guidance for creating and maintaining a clear and accessible `SECURITY.md ` file in the repository, which serves as the project's security policy. + +### Core Project Endorsement + +Endorsing this SPEC means agreeing, in principle, with the importance of having a clear `SECURITY.md ` file to describe how to responsibly report vulnerabilities. + +### Ecosystem Adoption + +Adopting this SPEC means implementing a security policy by including a `SECURITY.md ` file in the repository root. At a minimum, this file should describe how to report a security vulnerability and provide an expected response timeline. + +Other details of the security might vary depending on the project's size and attack surface. + +#### Badges + +Projects can highlight their adoption of this SPEC by including a SPEC badge. +{{< spec_badge number="15" title="Security Policy" >}} +To indicate adoption of multiple SPECS with one badge, see [this](../purpose-and-process/#badges). + + +## Implementation + +To add a security policy: +- For a single repository: create a `SECURITY.md `file in the root of the repo. +- For all repositories in an organization: create a `.github` repository and add a `SECURITY.md` file there. It will automatically apply to all repos without their own policy. + +> [!NOTE] +> With this approach individual repositories can edit the `SECURITY.md` as needed.) + +Once added, GitHub displays the security policy under the "Security" tab of each repository, making it easy for users to find and follow. + +A good `SECURITY.md` file should include the following sections: +- **Supported Versions**: Specify the range of versions that your project currently supports with security updates. +- **Contact information**: List an email address or other method users can use to reach the security team or maintainer. Ideally, use a dedicated address like `security@{PROJECT_NAME}.com` to manage security reports separately from general inquiries. * + +> [!NOTE] +> Sometimes the security contact is an external vendor or a vulnerability program. + +- **Reporting a Vulnerability**: Document how can users report a security issue (e.g., email address or link to a form). You can also enable [private vulnerability reporting on GitHub](https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository), which allows users to create private issues to report vulnerabilities directly and securely through the GitHub interface. In this case, your security policy should document how users can [privately report a vulnerability using GitHub](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability). +- **Expected Response Time**: Let users know how quickly you plan to respond (e.g., "within 72 hours"). + +### Template + +``` +# Security Policy + +## Supported Versions + +| Version | Supported | +|---------|-----------| +| Latest | ✅ | +| 1.x | ⚠️ Security fixes only | +| < 1.0 | ❌ Not supported | + +## Reporting a Vulnerability + +If you discover a security vulnerability in this project, we strongly encourage you to report it as soon as possible. Please include as much detail as possible to help us reproduce and address the issue quickly. + +- Email us at: [security@{PROJECT_NAME}.com] + +## Expected Response Time + +We aim to respond to vulnerability reports within **72 hours**, and follow [Responsible Disclosure model](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure). +``` + +## Notes + +- [More information on adding a security policy to a GitHub repository](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository) + From e4b4f4cefd3c3f4ca2846fbbb5a7ac8dac1e6836 Mon Sep 17 00:00:00 2001 From: juanis2112 Date: Tue, 13 May 2025 17:28:53 -0700 Subject: [PATCH 2/3] pre-commit --- spec-0015/index.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/spec-0015/index.md b/spec-0015/index.md index e4c7efe4..9d6fd663 100644 --- a/spec-0015/index.md +++ b/spec-0015/index.md @@ -11,8 +11,8 @@ endorsed-by: ## Description -A security policy in a GitHub repository helps users know how to report vulnerabilities responsibly and enables maintainers to respond effectively to security issues. This prevents senstive issues from being disclosed publicly before they are addressed. - +A security policy in a GitHub repository helps users know how to report vulnerabilities responsibly and enables maintainers to respond effectively to security issues. This prevents sensitive issues from being disclosed publicly before they are addressed. + This spec provides guidance for creating and maintaining a clear and accessible `SECURITY.md ` file in the repository, which serves as the project's security policy. ### Core Project Endorsement @@ -31,21 +31,22 @@ Projects can highlight their adoption of this SPEC by including a SPEC badge. {{< spec_badge number="15" title="Security Policy" >}} To indicate adoption of multiple SPECS with one badge, see [this](../purpose-and-process/#badges). - ## Implementation To add a security policy: + - For a single repository: create a `SECURITY.md `file in the root of the repo. -- For all repositories in an organization: create a `.github` repository and add a `SECURITY.md` file there. It will automatically apply to all repos without their own policy. +- For all repositories in an organization: create a `.github` repository and add a `SECURITY.md` file there. It will automatically apply to all repos without their own policy. > [!NOTE] > With this approach individual repositories can edit the `SECURITY.md` as needed.) - -Once added, GitHub displays the security policy under the "Security" tab of each repository, making it easy for users to find and follow. - + +Once added, GitHub displays the security policy under the "Security" tab of each repository, making it easy for users to find and follow. + A good `SECURITY.md` file should include the following sections: -- **Supported Versions**: Specify the range of versions that your project currently supports with security updates. -- **Contact information**: List an email address or other method users can use to reach the security team or maintainer. Ideally, use a dedicated address like `security@{PROJECT_NAME}.com` to manage security reports separately from general inquiries. * + +- **Supported Versions**: Specify the range of versions that your project currently supports with security updates. +- **Contact information**: List an email address or other method users can use to reach the security team or maintainer. Ideally, use a dedicated address like `security@{PROJECT_NAME}.com` to manage security reports separately from general inquiries. \* > [!NOTE] > Sometimes the security contact is an external vendor or a vulnerability program. @@ -80,4 +81,3 @@ We aim to respond to vulnerability reports within **72 hours**, and follow [Resp ## Notes - [More information on adding a security policy to a GitHub repository](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository) - From 941b95b839c853d003e34aef1cbbd1a12f8b5f1d Mon Sep 17 00:00:00 2001 From: juanis2112 Date: Tue, 13 May 2025 17:35:15 -0700 Subject: [PATCH 3/3] fix notes --- spec-0015/index.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/spec-0015/index.md b/spec-0015/index.md index 9d6fd663..f0249b26 100644 --- a/spec-0015/index.md +++ b/spec-0015/index.md @@ -38,8 +38,9 @@ To add a security policy: - For a single repository: create a `SECURITY.md `file in the root of the repo. - For all repositories in an organization: create a `.github` repository and add a `SECURITY.md` file there. It will automatically apply to all repos without their own policy. -> [!NOTE] -> With this approach individual repositories can edit the `SECURITY.md` as needed.) +{{< admonition note >}} +With this approach individual repositories can edit the `SECURITY.md` as needed.) +{{< /admonition >}} Once added, GitHub displays the security policy under the "Security" tab of each repository, making it easy for users to find and follow. @@ -48,8 +49,9 @@ A good `SECURITY.md` file should include the following sections: - **Supported Versions**: Specify the range of versions that your project currently supports with security updates. - **Contact information**: List an email address or other method users can use to reach the security team or maintainer. Ideally, use a dedicated address like `security@{PROJECT_NAME}.com` to manage security reports separately from general inquiries. \* -> [!NOTE] -> Sometimes the security contact is an external vendor or a vulnerability program. +{{< admonition note >}} +Sometimes the security contact is an external vendor or a vulnerability program. +{{< /admonition >}} - **Reporting a Vulnerability**: Document how can users report a security issue (e.g., email address or link to a form). You can also enable [private vulnerability reporting on GitHub](https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository), which allows users to create private issues to report vulnerabilities directly and securely through the GitHub interface. In this case, your security policy should document how users can [privately report a vulnerability using GitHub](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability). - **Expected Response Time**: Let users know how quickly you plan to respond (e.g., "within 72 hours").