Skip to content

Latest commit

 

History

History
40 lines (29 loc) · 2.32 KB

SECURITY.md

File metadata and controls

40 lines (29 loc) · 2.32 KB
Raw

Security Policies and Procedures

This document outlines security procedures and general policies for the migaloo-chain project.

Reporting a Bug

Security is something we take seriously at Migaloo. Thanks for taking the time to improve the security of migaloo-chain. We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions.

Please report security bugs by emailing White Whale at [email protected] or [email protected]. Do not report it publicly on the GitHub issues tracker. Your report should detail the necessary steps to reproduce the security issue. We will acknowledge your email within 48 hours and send a detailed response indicating the next steps. After the initial reply to your report, we will keep you informed of the progress towards a fix and full announcement and may ask for additional information or guidance.

Report security bugs in third-party modules to the person or team maintaining the module.

Disclosure Policy

If we receive a security bug report, we assign it to a primary handler. This person will coordinate the fix and release process, involving the following steps:

  • Confirm the problem and determine the affected versions.
  • Audit code to find any potentially similar problems.
  • Patches are prepared for eligible releases in private repositories.
  • We inform the community of an upcoming security release to provide ample time for users to update their systems. Notifications are sent through various channels such as Discord, Twitter, and email to partners and validators.
  • 24 hours after the notification, the security fixes are publicly implemented and new releases are made available.
  • Once the releases are available for Migaloo, the community is notified again through Discord, Twitter, and email to partners and validators.
  • Upon notification to the community, relevant bug bounties will be rewarded to submitters.
  • A week after the release, a post with details on the vulnerability and our response will be published.

Suggestions on this Policy

If you have suggestions on how to improve this process, please submit a pull request or reach out on Discord.