2b85e57b5d
The Airship security guide was last updated in 2018 and has not been maintained. It's coverage is limited to Airship 1 and is vague. This change removes it. Change-Id: Ibb8a74f6a13d0e66dba92e45ff4891eb25327ce9 Signed-off-by: Drew Walters <andrew.walters@att.com>
3.4 KiB
Airship Security Vulnerability Management
The Airship community is committed to expediently confirming, resolving, and disclosing all reported security vulnerabilities. We appreciate your cooperation and participation in our vulnerability management process outlined below.
Report a Vulnerability
If you discover a vulnerability in an Airship project, please treat the issue with a sense of confidentiality and disclose it to the airship-security mailing list:
Additionally, please include any potential fixes, as doing so can expedite the disclosure and patching processes.
The Airship Working Committee is the sole subscriber of the airship-security mailing list and monitors it for reported vulnerabilities. The committee confirms or rejects reported vulnerabilities in correspondence with the vulnerability reporter. In the event that the Airship Working Committee does not have the expertise or availability to resolve a reported vulnerability, the committee may solicit assistance from outside contributors to better facilitate the understanding and resolution of reported security vulnerabilities.
Receive Early Disclosures
We prefer to disclose confirmed security vulnerabilities as soon as possible. While circumstances may not always allow immediate disclosure, vulnerabilities may be disclosed over the airship-embargo-notice mailing list when a fix becomes available. The airship-embargo-notice mailing list notifies Airship users of confirmed vulnerabilities. If you operate Airship in a production environment, we recommend subscribing to the airship-embargo-notice mailing list by contacting the Airship Working Committee. The Airship Working Committee evaluates subscription requests on a case-by-case basis.
Receive Public Disclosures
Within ninety days of the initial vulnerability report, except in unusual circumstances, the Airship Working Committee will publicly disclose the reported vulnerability and its mitigation over the airship-announce and airship-discuss mailing lists. If a fix merges before the aforementioned ninety day period expires, the Airship Working Committee will instead disclose the vulnerability and fix twenty-one days later. We recommend subscribing to both mailing lists in order to receive security updates.