diff --git a/.changeset/security-policy.md b/.changeset/security-policy.md new file mode 100644 index 00000000..a845151c --- /dev/null +++ b/.changeset/security-policy.md @@ -0,0 +1,2 @@ +--- +--- diff --git a/SECURITY.md b/SECURITY.md index fd72ba0e..51201c86 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,18 +2,25 @@ ## Supported Versions -Use this section to tell people about which versions of your project are -currently being supported with security updates. +Security fixes land on **nostream 3.5 and newer** only. The current release line is 3.6.x (3.6.1 at the time of writing). -| Version | Supported | -| --------- | ------------------ | -| > 1.11.x | :white_check_mark: | -| < 1.9.0 | :x: | +| Version | Supported | +| --------------- | ------------------ | +| 3.5.x and newer | :white_check_mark: | +| 3.0.x – 3.4.x | :x: | +| 2.x | :x: | +| 1.x | :x: | + +Unsupported lines receive no advisories, backports or patches. If you run one of them, upgrade to a supported version before reporting. + +The Rust rewrite (`rewrite/main`) does not ship a release yet. It is covered by this policy as it ships. ## Reporting a Vulnerability -Use this section to tell people how to report a vulnerability. +Please do not open a public issue for a security problem. Report it privately through GitHub's private vulnerability reporting: + + + +Include the affected version, how your deployment is configured, and steps to reproduce. -Tell them where to go, how often they can expect to get an update on a -reported vulnerability, what to expect if the vulnerability is accepted or -declined, etc. +You can expect a first response within 7 days. After that, we will keep you updated on the progress of the report. If the report is accepted, we will work on a fix and publish a security advisory once a patched release is available. If it is declined, we will explain why.