67 lines
2.8 KiB
Markdown
67 lines
2.8 KiB
Markdown
# LiveCodes Security and Responsible Disclosure Policy <!-- omit in toc -->
|
|
|
|
This document outlines security procedures and general policies for
|
|
LiveCodes projects as found on https://github.com/live-codes.
|
|
|
|
- [Reporting a Vulnerability](#reporting-a-vulnerability)
|
|
- [Disclosure Policy](#disclosure-policy)
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Please do not report security vulnerabilities through public GitHub issues.**
|
|
|
|
All security vulnerabilities are taken seriously. Thank you for
|
|
improving the security of our open source software. We appreciate
|
|
your efforts and responsible disclosure and will make every effort
|
|
to acknowledge your contributions.
|
|
|
|
Please report security vulnerabilities by email at: security@livecodes.io
|
|
|
|
- Type of issue (e.g. cross-site scripting, authentication or authorization flaws etc.)
|
|
- Version(s) of the App/SDK affected.
|
|
- Full paths of source file(s) related to the manifestation of the issue
|
|
- The location of the affected source code (tag/branch/commit or direct URL)
|
|
- Any special configuration required to reproduce the issue
|
|
- Step-by-step instructions to reproduce the issue
|
|
- Proof-of-concept or exploit code (if possible)
|
|
- Impact of the issue, including how an attacker might exploit the issue
|
|
|
|
This information will help us triage your report more quickly.
|
|
|
|
We will acknowledge your email, and will send a response indicating
|
|
the next steps in handling your report. After the initial reply to
|
|
your report, we will endeavor to keep you informed of the progress towards
|
|
a fix and full announcement, and may ask for additional information or guidance.
|
|
|
|
To show our appreciation for your effort and cooperation during the report,
|
|
we will list your name and a link to a personal website/social network profile
|
|
on the page below so that the public can know you've helped keep LiveCodes secure.
|
|
|
|
Please report security vulnerabilities in third-party modules to the person or
|
|
team maintaining the module.
|
|
|
|
## Disclosure Policy
|
|
|
|
Please follow these rules when testing/reporting vulnerabilities:
|
|
|
|
- Do not take advantage of the vulnerability you have discovered.
|
|
- Do not read, modify or delete data that isn't you own.
|
|
- We ask that you do not to disclose the problem to third parties
|
|
until it has been resolved and only after consultation with LiveCodes team.
|
|
|
|
When a security bug report is received, the following steps are followed:
|
|
|
|
- Confirm the problem and determine the affected versions.
|
|
- Audit code to find any potential similar problems.
|
|
- Prepare fixes for all releases still under maintenance. These fixes
|
|
will be released as fast as possible.
|
|
|
|
<!--
|
|
|
|
## Acknowledgement
|
|
|
|
We sincerely appreciate the efforts of security researchers in keeping our community safe. The following people have responsibly disclosed vulnerabilities to us in the past:
|
|
|
|
- Name (with link to website)
|
|
-->
|