Skip to content

Latest commit

 

History

History
27 lines (19 loc) · 2.45 KB

SECURITY-template.md

File metadata and controls

27 lines (19 loc) · 2.45 KB
Raw

Security Guidelines for this Project

How the [ORG NAME] Security Team Manages Security for this Project

[ORG NAME] takes security seriously and wants to ensure that we maintain a secure environment for our customers and that we also provide secure solutions for the open source community. To help us achieve these goals, please note the following before using this software:

  • Review the software license to understand [ORG NAMES]'s obligations in terms of warranties and suitability for purpose
  • For any questions or concerns about security, you can reach out directly to [ORG NAMES]'s security team at [SECURITY EMAIL ADDRESS OR CONTACT FORM]
  • We request that you work with our security team and opt for responsible disclosure using the guidelines below
  • This software repository is included in [ORG NAMES]'s Bug Bounty program, we reward those who help us keep our code secure (if you do not want to participate in the bug bounty program, you can report directly to us as well)
  • We enforce SLAs on our security team and software engineers to remediate security bugs in a timely manner
  • All security related issues and pull requests you make should be tagged with "security" for easy identification
  • Please monitor this repository and update your environment in a timely manner as we release patches and updates

Responsibly Disclosing Security Bugs to [ORG NAME]

If you find a security bug in this repository, please work with [ORG NAME]'s security team following responsible disclosure principles and these guidelines:

  • Do not submit a normal issue or pull request in our public repository, instead report through directly to [SECURITY EMAIL ADDRESS OR CONTACT FORM]
  • We will review your submission and may follow up for additional details
  • If you have a patch, we will review it and approve it privately; once approved for release you can submit it as a pull request publicly in our repos (we give credit where credit is due)
  • We will keep you informed during our investigation, feel free to check in for a status update
  • We will release the fix and publicly disclose the issue as soon as possible, but want to ensure we due proper due diligence before releasing

Contact / Misc.

If you have any questions, please reach out directly to the [ORG NAME] Security team at [SECURITY EMAIL ADDRESS OR CONTACT FORM]