|
1 | | -# Vulnerability Reporting Process |
| 1 | +# Security |
2 | 2 |
|
3 | | -Security is the number one priority for cert-manager. If you think you've found a |
4 | | -security vulnerability in a cert-manager project, you're in the right place. |
5 | | - |
6 | | -Our reporting procedure is a work-in-progress, and will evolve over time. We |
7 | | -welcome advice, feedback and pull requests for improving our security |
8 | | -reporting processes. |
9 | | - |
10 | | -## Covered Repositories and Issues |
11 | | - |
12 | | -When we say "a security vulnerability in cert-manager" we mean a security issue |
13 | | -in any repository under the [cert-manger GitHub organization](https://github.com/cert-manager/). |
14 | | - |
15 | | -This reporting process is intended only for security issues in the cert-manager |
16 | | -project itself, and doesn't apply to applications _using_ cert-manager or to |
17 | | -issues which do not affect security. |
18 | | - |
19 | | -Broadly speaking, if the issue cannot be fixed by a change to one of the covered |
20 | | -repositories above, then it might not be appropriate to use this reporting |
21 | | -mechanism and a GitHub issue in the appropriate repo or a question in Slack |
22 | | -might be a better choice. |
23 | | - |
24 | | -All that said, **if you're unsure** please reach out using this process before |
25 | | -raising your issue through another channel. We'd rather err on the side of |
26 | | -caution! |
27 | | - |
28 | | -### Explicitly Not Covered: Vulnerability Scanner Reports |
29 | | - |
30 | | -We do not accept reports which amount to copy and pasted output from a vulnerability |
31 | | -scanning tool **unless** work has specifically been done to confirm that a vulnerability |
32 | | -reported by the tool _actually exists_ in cert-manager or a cert-manager subproject. |
33 | | - |
34 | | -We make use of these tools ourselves and try to act on the output they produce; they |
35 | | -can be useful! We tend to find, however, that when these reports are sent to our security |
36 | | -mailing list they almost always represent false positives, since these tools tend to check |
37 | | -for the presence of a library without considering how the library is used in context. |
38 | | - |
39 | | -If we receive a report which seems to simply be a vulnerability list from a scanner we |
40 | | -reserve the right to ignore it. |
41 | | - |
42 | | -This applies especially when tools produce vulnerability identifiers which are not publicly |
43 | | -visible or which are proprietary in some way. We can look up CVEs or other publicly-available |
44 | | -identifiers for further details, but cannot do the same for proprietary identifiers. |
45 | | - |
46 | | -## Security Contacts |
47 | | - |
48 | | -The people who should have access to read your security report are listed in |
49 | | -[`SECURITY_CONTACTS.md`](./SECURITY_CONTACTS.md) |
50 | | - |
51 | | -## Reporting Process |
52 | | - |
53 | | -1. Describe the issue in English, ideally with some example configuration or |
54 | | - code which allows the issue to be reproduced. Explain why you believe this |
55 | | - to be a security issue in cert-manager, if that's not obvious. |
56 | | -2. Put that information into an email. Use a descriptive title. |
57 | | -3. Send the email to [`[email protected]`](mailto:[email protected]) |
58 | | - |
59 | | -## Response |
60 | | - |
61 | | -Response times could be affected by weekends, holidays, breaks or time zone |
62 | | -differences. That said, the security response team will endeavour to reply as |
63 | | -soon as possible, ideally within 3 working days. |
64 | | - |
65 | | -If the team concludes that the reported issue is indeed a security |
66 | | -vulnerability in a cert-manager project, at least two members of the security |
67 | | -response team will discuss the next steps together as soon as possible, ideally |
68 | | -within 24 hours. |
69 | | - |
70 | | -As soon as the team decides that the report is of a genuine vulnerability, |
71 | | -one of the team will respond to the reporter acknowledging the issue and |
72 | | -establishing a disclosure timeline, which should be as soon as possible. |
| 3 | +Please refer to the [cert-manager organisation security document](https://github.com/cert-manager/community/blob/main/SECURITY.md). |
0 commit comments