Skip to content

Security: svengreb/tmpl-go

Security

security.md

Security Policies And Procedures

Note By interacting with @svengreb projects, organizations, and their communities you agree to abide to its code of conduct and follow general open source contribution guidelines and etiquettes!

This document outlines security procedures and policies for security vulnerabilities in @svengreb projects.

The security of projects is taken seriously, which includes all @svengreb (source code) repositories as well as any managed organization, or organizations this account is part of with a maintainer-like role, and their communities.

If you believe you have found a security vulnerability 1 in any repository that meets the definition of vulnerabilities, please report it as described below.

Scope

Reports should only be related to…

  • projects within the @svengreb GitHub account. Only code that is actually owned by @svengreb, or any managed organization, is supported while issues related to upstream projects, e.g. plugins or extensions, must be reported to the corresponding maintainers or companies of the upstream project. Support to report issues to the upstream team might be provided, but we are not responsible for security vulnerabilities in upstream projects in any way.
  • any (GitHub) organization managed by @svengreb, or organizations this account is part of with a maintainer-like role, and their communities. The same scope applies like for projects within the @svengreb GitHub account, but additionally the task of the security vulnerability handling and disclosure process is part of the corresponding maintainer team when the project is also maintained by a community. Of course @svengreb will aid in closing issues as quickly as possible, but the main administration lies with the respective maintainers.

Reporting Security Issues

Warning Never report security vulnerabilities through public GitHub issues or any other public (communication) channel or platform!

Instead, please report security vulnerabilities by either…

Public keys for encrypted communications:

Age
    age1ul0s8ctrsdydx68qs3t66ev5uhq700dt49pnqz3enh59qcrcyvasq7gvw8r
  
PGP (GPG)

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEZDvNbhYJKwYBBAHaRw8BAQdAAEZ+vBmlMnqdThx/vffo1TNpsFY0GxeJLelk tONB+ua0JVN2ZW4gR3JlYiAoc3ZlbmdyZWIpIDxtZUBzdmVuZ3JlYi5kZT6IkwQT FgoAOxYhBJq2ns8GnhxoSWFy9p7D3JDapH2qBQJkO81uAhsDBQsJCAcCAiICBhUK CQgLAgQWAgMBAh4HAheAAAoJEJ7D3JDapH2qvn8A/0+U0gGqHM8OIRBtw0UPqaop x5ojQ1FPZus5Upbcy+YaAP0YwCVnz4qrg9S/rQ5G0igRMidCl1InVRJ6ict3oTf5 CLg4BGQ7zW4SCisGAQQBl1UBBQEBB0AU2br3WMbWE37vQRI1xC9f1qq5HBWY9cYc SUO7D0wKEQMBCAeIeAQYFgoAIBYhBJq2ns8GnhxoSWFy9p7D3JDapH2qBQJkO81u AhsMAAoJEJ7D3JDapH2qFHUBAPFMiNWO7iiv0j7Syj5RTWHE15wb4YbV2MKJ4bqr YvqtAQDJPujvk/2c0Og4nUGs0lBvU9dIicc5Va/JyjDAIK0JBg== =Kb0/ -----END PGP PUBLIC KEY BLOCK-----

Please include as much information as possible, using the questions listed below as a guideline, to help us better understand the nature and scope of the possible issue and help us triage the report more quickly:

  • Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
  • Full paths of source file(s) related to the manifestation of the issue
  • The location of the affected source code (tag/branch/commit or direct URL)
  • Any special configuration required to reproduce the issue
  • Step-by-step instructions to reproduce the issue
  • Proof-of-concept or exploit code (if possible)
  • Impact of the issue, including how an attacker might exploit the issue

Note that all communications, following the global standard, must be in English to ensure that the process can take place with as few language barriers as possible and to avoid possible translation problems during the process.

Public Disclosure Process

Confirmed vulnerabilities will be investigated and patched as quickly as possible and rolled out to affected users through a patch or minor release version, depending on the status of the current project development, release cycle process and ways to backport to other supported versions.

Resolved security vulnerabilities will be made public as advisory []6 []7 on GitHub and, in most cases, additionally announced via other official communication channels and platforms. This might also include a guide on how to apply mitigating steps to aid users in closing the security vulnerability as simply as possible.

Copyright © 2016-present Sven Greb

Footnotes

  1. https://csrc.nist.gov/glossary/term/vulnerability

  2. https://age-encryption.org

  3. https://www.openpgp.org

  4. https://github.com/svengreb/.github/blob/main/data/svengreb.age.txt.pub

  5. https://github.com/svengreb/.github/blob/main/data/svengreb.gpg.asc

  6. https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/about-coordinated-disclosure-of-security-vulnerabilities

  7. https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure

There aren’t any published security advisories