security: add vulnerability reporting policy and response timeline

Swadhin Biswas committed 7 months ago

864df05

1 parent a3a1340

commit 864df05

1 file changed

+37 -0

Files

Showing 1 changed file+37-0

▼SECURITY.md

+37-0

@@ -0,0 +1,37 @@
	1	+# Security Policy
	2	+
	3	+## Supported Versions
	4	+
	5	+\| Version \| Supported \|
	6	+\| ------- \| ------------------ \|
	7	+\| 0.1.x \| :white_check_mark: \|
	8	+\| < 0.1.0 \| :x: \|
	9	+
	10	+## Reporting a Vulnerability
	11	+
	12	+If you discover a security vulnerability in contexa, please report it responsibly by emailing [email protected] with the following information:
	13	+
	14	+- Description of the vulnerability
	15	+- Steps to reproduce
	16	+- Affected language(s) and version(s)
	17	+- Impact assessment
	18	+
	19	+Please do NOT open a public issue for security vulnerabilities. Responsible disclosure helps protect all users of the project.
	20	+
	21	+## Response Timeline
	22	+
	23	+- Acknowledgment — within 48 hours of receiving the report
	24	+- Initial assessment — within 1 week
	25	+- Fix and disclosure timeline — agreed upon with the reporter on a case-by-case basis
	26	+
	27	+## Scope
	28	+
	29	+This security policy covers all 7 language implementations of contexa:
	30	+
	31	+- Python
	32	+- JavaScript
	33	+- Rust
	34	+- Go
	35	+- Zig
	36	+- Lua
	37	+- Elixir
0	38