62 lines
2.4 KiB
ReStructuredText
62 lines
2.4 KiB
ReStructuredText
Security
|
||
========
|
||
|
||
We take the security of ``lemur`` seriously. The following are a set of
|
||
policies we have adopted to ensure that security issues are addressed in a
|
||
timely fashion.
|
||
|
||
Reporting a security issue
|
||
--------------------------
|
||
|
||
We ask that you do not report security issues to our normal GitHub issue
|
||
tracker.
|
||
|
||
If you believe you've identified a security issue with ``lemur``, please
|
||
report it to ``cloudsecurity@netflix.com``.
|
||
|
||
Once you've submitted an issue via email, you should receive an acknowledgment
|
||
within 48 hours, and depending on the action to be taken, you may receive
|
||
further follow-up emails.
|
||
|
||
Supported Versions
|
||
------------------
|
||
|
||
At any given time, we will provide security support for the `master`_ branch
|
||
as well as the most recent release.
|
||
|
||
Disclosure Process
|
||
------------------
|
||
|
||
Our process for taking a security issue from private discussion to public
|
||
disclosure involves multiple steps.
|
||
|
||
Approximately one week before full public disclosure, we will provide advanced notification that a security issue exists. Depending on the severity of the issue, we may choose to either send a targeted email to known Lemur users and contributors or post an issue to the Lemur repository. In either case, the notification should contain the following.
|
||
|
||
* A description of the potential impact
|
||
* The affected versions of ``lemur``.
|
||
* The steps we will be taking to remedy the issue.
|
||
* The date on which the ``lemur`` team will apply these patches, issue
|
||
new releases, and publicly disclose the issue.
|
||
|
||
If the issue was disclosed to us, the reporter will receive notification of the date
|
||
on which we plan to make the issue public.
|
||
|
||
On the day of disclosure, we will take the following steps:
|
||
|
||
* Apply the relevant patches to the ``lemur`` repository. The commit
|
||
messages for these patches will indicate that they are for security issues,
|
||
but will not describe the issue in any detail; instead, they will warn of
|
||
upcoming disclosure.
|
||
* Issue an updated release.
|
||
|
||
If a reported issue is believed to be particularly time-sensitive – due to a
|
||
known exploit in the wild, for example – the time between advance notification
|
||
and public disclosure may be shortened considerably.
|
||
|
||
The list of people and organizations who receives advanced notification of
|
||
security issues is not, and will not, be made public. This list generally
|
||
consists of high-profile downstream distributors and is entirely at the
|
||
discretion of the ``lemur`` team.
|
||
|
||
.. _`master`: https://github.com/Netflix/lemur
|