Skip to content
This repository has been archived by the owner on Feb 1, 2022. It is now read-only.

Latest commit

 

History

History
40 lines (29 loc) · 1.7 KB

SECURITY.md

File metadata and controls

40 lines (29 loc) · 1.7 KB
Raw

Security Issues

This document explains how Check-Je-Huis security issues are handled by the StadGent team.

Reporting a Security Issue

If you think that you have found a security issue in Check-Je-Huis, do not use the issue tracker and do not publish it publicly. Instead, all security issues must be sent to security [at] gent.be.

Resolving Process

For each report, we first try to confirm the vulnerability. When it is confirmed, we will work on a solution following these steps:

  • Send an acknowledgement to the reporter
  • Work on a patch
  • Write a security announcement for this repository about the vulnerability. This will be posted as a wiki page and referenced from this file. It will contain at least the following:
    • a title that always include the "Security release" string
    • a description of the vulnerability
    • the affected versions
    • the possible exploits
    • how to patch/upgrade/workaround affected applications
    • the CVE identifier
    • credits
  • Send the patch and the announcement to the reporter for review
  • Apply the patch to Check-Je-Huis and release a new version
  • Publish the wiki page on this repository
  • Update the security advisory list (see below)

Releases that include security issues should not be done on Saturday or Sunday, except if the vulnerability has been publicly posted.

While we are working on a patch, please do not reveal the issue publicly.

The resolution takes anywhere between a couple of days to a month depending on its complexity and the coordination with the downstream projects (see next paragraph).

Security Advisories

This section indexes security vulnerabilities that were fixed in Check-Je-Huis releases, starting from Check-Je-Huis 1.0.0