well-goknown/vendor/github.com/fasthttp/websocket/SECURITY.md at ccbc49773496d3aa80a423b5f3686c85683ff9b5

Asara/well-goknown

Fork 0

Asara 1dbe1dc2c7 replace context with caller for zerolog, add vendor

2024-09-16 21:01:50 -04:00

6.6 KiB

Raw Blame History

TL;DR

We use a simplified version of Golang Security Policy. For example, for now we skip CVE assignment.

Reporting a Security Bug

Please report to us any issues you find. This document explains how to do that and what to expect in return.

All security bugs in our releases should be reported by email to oss-security@highload.solutions. This mail is delivered to a small security team. Your email will be acknowledged within 24 hours, and you'll receive a more detailed response to your email within 72 hours indicating the next steps in handling your report. For critical problems, you can encrypt your report using our PGP key (listed below).

Please use a descriptive subject line for your report email. After the initial reply to your report, the security team will endeavor to keep you informed of the progress being made towards a fix and full announcement. These updates will be sent at least every five days. In reality, this is more likely to be every 24-48 hours.

If you have not received a reply to your email within 48 hours or you have not heard from the security team for the past five days please contact us by email to developers@highload.solutions or by Telegram message to our support. Please note that developers@highload.solutions list includes all developers, who may be outside our opensource security team. When escalating on this list, please do not disclose the details of the issue. Simply state that you're trying to reach a member of the security team.

If you believe that an existing issue is security-related, we ask that you send an email to oss-security@highload.solutions. The email should include the issue ID and a short description of why it should be handled according to this security policy.

Disclosure Process

Our project uses the following disclosure process:

Once the security report is received it is assigned a primary handler. This person coordinates the fix and release process.
The issue is confirmed and a list of affected software is determined.
Code is audited to find any potential similar problems.
Fixes are prepared for the two most recent major releases and the head/master revision. These fixes are not yet committed to the public repository.
To notify users, a new issue without security details is submitted to our GitHub repository.
Three working days following this notification, the fixes are applied to the public repository and a new release is issued.
On the date that the fixes are applied, announcement is published in the issue.

This process can take some time, especially when coordination is required with maintainers of other projects. Every effort will be made to handle the bug in as timely a manner as possible, however it's important that we follow the process described above to ensure that disclosures are handled consistently.

Receiving Security Updates

The best way to receive security announcements is to subscribe ("Watch") to our repository. Any GitHub issues pertaining to a security issue will be prefixed with [security].

Comments on This Policy

If you have any suggestions to improve this policy, please send an email to oss-security@highload.solutions for discussion.

PGP Key for oss-security@highload.solutions

We accept PGP-encrypted email, but the majority of the security team are not regular PGP users so it's somewhat inconvenient. Please only use PGP for critical security reports.

6.6 KiB Raw Blame History