Skip to content

Latest commit

 

History

History
101 lines (76 loc) · 7.63 KB

SECURITY.md

File metadata and controls

101 lines (76 loc) · 7.63 KB
Raw

Security Policy

Reporting a Vulnerability

To report a security issue, please email carbon-aware-sdk@greensoftware.foundation with a description of the issue, steps required to reproduce the issue, affected versions and, if known, mitigations for the issue.

Our contributors are comprised of volunteers so we cannot guarantee a specific response time, but someone from our team will reply and address the issue as soon as possible.

Security Review

We perform regular reviews inline with the information provided below. All releases go through these reviews but multiple people in the project team prior to release as part of our quality and security review.

Basics

Basic Project Website Content

FLOSS license

Documentation

Other

Change control

Public VCS repo

Unique versioning numbering

Release notes

Reporting

Bug reporting process

Vulnerability report process

  • Have a vulnerability report process - ✅ Added in this PR: #464
  • Private vulnerability if supported must include info how to send - ✅ N/A (allowed) - no private vulnerability reporting set up but proposed
  • Initial response time for vulnerability submitted in last 6 months must be <= 14 days - ✅ N/A (allowed) - project run by volunteers, does not provide response time guarantee as stated in SECURITY.md (this pr)

Quality

Working build system

Automated test suite

New functionaility testing

Warning flags

Security

Secure development knowledge

  • At least one primary developer who knows how to design secure software - ✅ @vaughanknight is at least one of them :)
  • At least one of the project's primary developers MUST know of common kinds of errors that lead to vulnerabilities in this kind of software, as well as at least one method to counter or mitigate each of them - ✅

Use basic good cryptographic practices

Secured delivery against man-in-the-middle (MITM) attacks

  • Delivery mechanisms that counters MITM - ✅ uses HTTPS
  • Cyrptographic hash NOT retrived over HTTP - ✅ ues HTTPS

Publicly known vulnerabilities fixed

  • No unpatched vulnerabilities of medium or higher severity that have been publicly known for more than 60 day - ✅ no such vulnerabilities

Other security issues

  • Public repo doesnt leak private credential - ✅ does not do that

Analysis

Static code analysis

Dynamic code analysis

  • All medium and higher severity exploitable vulnerabilities discovered with dynamic code analysis MUST be fixed in a timely way after they are confirmed. - ✅ N/A (allowed, no Dynamic code analysis in place).