-
Notifications
You must be signed in to change notification settings - Fork 163
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
docs: add security policy to repo root
Signed-off-by: Xander Grzywinski <xandergrzyw@gmail.com>
- Loading branch information
1 parent
898061d
commit 4174e2b
Showing
1 changed file
with
17 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
# Reporting Security Issues | ||
|
||
To report a security issue or vulnerability in Zarf, please use the confidential GitHub Security Advisory ["Report a Vulnerability"](https://github.com/defenseunicorns/zarf/security/advisories) tab. The Zarf team will send a response indicating the next steps in handling your report. After the initial reply to your report, the team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance. | ||
|
||
### When Should I Report a Vulnerability? | ||
|
||
* You found a vulnerability in the Zarf code. | ||
* You found a vulnerability in one of the Zarf dependencies that affects the project that has not been patched yet. | ||
|
||
### When Should I NOT Report a Vulnerability? | ||
|
||
* You found a bug or malfunction in the Zarf code (not security related). | ||
* You want to add a feature to Zarf. | ||
|
||
## Contacting Us | ||
|
||
To discuss security related issues, please email the maintainers at zarf-dev-private@googlegroups.com. |