Update SECURITY.md (#38)

rnro · web-flow · commit 7617e7288306 · 2025-05-07T08:35:17.000+01:00
Update SECURITY.md

### Motivation:

To give up-to-date guidance on submitting security vulnerabilities.

### Modifications:

Updated the Disclosures section of SECURITY.md

### Result:

More accurate guidance on submitting information on security
vulnerabilities.
diff --git a/SECURITY.md b/SECURITY.md
@@ -1,44 +1,12 @@
-# Security
+If you believe that you have discovered a security or privacy vulnerability in our open source software, please report it to us using the GitHub private vulnerability feature. Reports should include specific product and software version(s) that you believe are affected; a technical description of the behavior that you observed and the behavior that you expected; the steps required to reproduce the issue; and a proof of concept or exploit.
 
-This document specifies the security process for the Swift NIO Oblivious HTTP project.
+The project team will do their best to acknowledge receiving all security reports within 7 days of submission. This initial acknowledgment is neither acceptance nor rejection of your report. The project team may come back to you with further questions or invite you to collaborate while working through the details of your report.
 
-## Disclosures
+Keep these additional guidelines in mind when submitting your report:
 
-### Private Disclosure Process
+* Reports concerning known, publicly disclosed CVEs can be submitted as normal issues to this project.
+* Output from automated security scans or fuzzers MUST include additional context demonstrating the vulnerability with a proof of concept or working exploit.
+* Application crashes due to malformed inputs are typically not treated as security vulnerabilities, unless they are shown to also impact other processes on the system.
 
-The Swift NIO core team asks that known and suspected vulnerabilities be
-privately and responsibly disclosed by emailing
-[sswg-security-reports@forums.swift.org](mailto:sswg-security-reports@forums.swift.org)
-with all the required detail.
-**Do not file a public issue.**
 
-#### When to report a vulnerability
-
-* You think you have discovered a potential security vulnerability in Swift NIO Oblivious HTTP.
-* You are unsure how a vulnerability affects Swift NIO Oblivious HTTP.
-
-#### What happens next?
-
-* A member of the team will acknowledge receipt of the report within 3
-  working days (United States). This may include a request for additional
-  information about reproducing the vulnerability.
-* We will privately inform the Swift Server Work Group ([SSWG][sswg]) of the
-  vulnerability within 10 days of the report as per their [security
-  guidelines][sswg-security].
-* Once we have identified a fix we may ask you to validate it. We aim to do this
-  within 30 days. In some cases this may not be possible, for example when the
-  vulnerability exists at the protocol level and the industry must coordinate on
-  the disclosure process.
-* If a CVE number is required, one will be requested from [MITRE][mitre]
-  providing you with full credit for the discovery.
-* We will decide on a planned release date and let you know when it is.
-* Prior to release, we will inform major dependents that a security-related
-  patch is impending.
-* Once the fix has been released we will publish a security advisory on GitHub
-  and the [SSWG][sswg] will announce the vulnerability on the [Swift
-  forums][swift-forums-sec].
-
-[sswg]: https://github.com/swift-server/sswg
-[sswg-security]: https://www.swift.org/sswg/security/
-[swift-forums-sec]: https://forums.swift.org/c/server/security-updates/
-[mitre]: https://cveform.mitre.org/
+While we welcome reports for open source software projects, they are not eligible for Apple Security Bounties.
