Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create SECURITY.md #1555

Merged
merged 2 commits into from
Jan 31, 2022
Merged

Create SECURITY.md #1555

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d81afbd
Create SECURITY.md
remkop Jan 31, 2022
76fd1d4
[#1555] SECURITY: update RELNOTES for SECURITY.md
remkop Jan 31, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions RELEASE-NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ Picocli follows [semantic versioning](http://semver.org/).
* [#1544][#1545] DOC: Add NOTICE file with GPL v2 + CPE license. Thanks to [Keith M Swartz](https://github.com/kswartz26) for the pull request.
* [#1553] SECURITY: Fix code scanning alert - Token-Permissions
* [#1554] SECURITY: Fix code scanning alert - Pinned-Dependencies
* [#1555] SECURITY: Fix code scanning alert - Create SECURITY.md
* [#1491] BUILD: Add build job in CI; Thanks to [Goooler](https://github.com/Goooler) for the pull request.
* [#1482] BUILD: Optimize gradle; Thanks to [Goooler](https://github.com/Goooler) for the pull request.
* [#1461] BUILD: Allow publishing without signing for non-release versions. Thanks to [Andreas Deininger](https://github.com/deining) for raising this.
Expand Down
26 changes: 26 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
# Security Policy

## Reporting a Vulnerability

Please report vulnerabilities you find in picocli to:

```
rpopma at apache.org
```

Anyone can send email to this address.
The resolution of any reported security issues will be handled in confidence.
In your report, please note how you would like to be credited for discovering the issue.

## Supported Versions

| Version | Supported |
| ------------- | ------------------ |
| latest 4.x.x | :white_check_mark: |
| older 4.x.x | :x: |
| < 4.0 | :x: |

## Why follow this process
Due to the sensitive nature of security bugs, the disclosure process is more constrained than a regular bug.
We appreciate you following these industry accepted guidelines, which gives time for a proper fix and limit the time window of attack.