3e5239f7d3
This commit incorporates Static Analysis Security Testing (SAST) using CodeQL. This integration will enforce consistent security assessments with every change and on a predetermined schedule. This commit also involves a restructure of security checks. The existing security-checks workflow is renamed to better reflect its functionality related to dependency audits. These changes will enhance the project's resilience against potential vulnerabilities in both the codebase and third-party dependencies. Changes include: - Remove older LGTM badge that's replaced by SAST checks. - Rename `checks.security.yaml` to `checks.security.dependencies.yaml`, reinforcing the focus on dependency audits. - Update `README.md`, ensuring the clear representation of security check statuses, including new SAST integration. - Add new `SECURITY.md`, establishing the protocol for reporting vulnerabilities and outlining the project's commitment to robust security testing. - Enhance `docs/tests.md` with detailed information on the newly integrated security checks. - Add reference to SECURITY.md in README.md.
32 lines
1.5 KiB
Markdown
32 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
privacy.sexy takes security seriously. Commitment is made to address all security issues with urgency. Responsible reporting of any discovered vulnerabilities in the project is highly encouraged.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Efforts to responsibly disclose findings are greatly appreciated. To report a security vulnerability, follow these steps:
|
|
|
|
- For general vulnerabilities, [open an issue](https://github.com/undergroundwires/privacy.sexy/issues/new/choose) using the bug report template.
|
|
- For sensitive matters, [contact the developer directly](https://undergroundwires.dev).
|
|
|
|
## Security Report Handling
|
|
|
|
Upon receipt of a security report, the following actions will be taken:
|
|
|
|
- The report will be confirmed, identifying the affected components.
|
|
- The impact and severity of the issue will be assessed.
|
|
- Work on a fix and plan a release to address the vulnerability will be initiated.
|
|
- The reporter will be kept updated about the progress.
|
|
|
|
## Testing
|
|
|
|
Regular and extensive testing is conducted to ensure robust security in the project. Information about testing practices can be found in the [Testing Documentation](./docs/tests.md).
|
|
|
|
## Support
|
|
|
|
For additional assistance or any unanswered questions, [submit a GitHub issue](https://github.com/undergroundwires/privacy.sexy/issues/new/choose). Security concerns are a priority, and necessary support to address them is assured.
|
|
|
|
---
|
|
|
|
Active contribution to the safety and security of privacy.sexy is thanked. This collaborative effort keeps the project resilient and trustworthy for all.
|