AIL/ail-framework
7
0
Fork 0
mirror of https://github.com/ail-project/ail-framework.git synced 2024-11-10 08:38:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'master' of github.com:ail-project/ail-framework

Browse source
This commit is contained in:
Terrtia 2022-02-16 10:20:20 +01:00
commit 303c8001e5
No known key found for this signature in database
GPG key ID: 1E1B1F50D84613D0
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
SECURITY.md Normal file
View file

@ -0,0 +1,13 @@
# Security Policy
## Reporting security vulnerabilities for AIL or related AIL project repositories
Reporting security vulnerabilities is of great importance for us, as AIL is used by different security operators and organisations.
In the case of a security vulnerability report, we ask the reporter to send it directly to [CIRCL](https://www.circl.lu/contact/), if possible encrypted with the following GnuPG key: **CA57 2205 C002 4E06 BA70 BE89 EAAD CFFC 22BD 4CD5**. We usually fix reported and confirmed security vulnerabilities in less than 48 hours, followed by a software release containing the fixes within the following days.
If you report security vulnerabilities, do not forget to **tell us if and how you want to be acknowledged** and if you already requested CVE(s). Otherwise, we will request the CVE(s) directly.
As one of the critical user-bases of AIL project consists of the CSIRT community, it is our duty to clearly state which bug could be abused and have a security impact on a AIL instance. CVE assignment is performed even for minor bugs suspected of having a security impact. This allows every user with AIL instances set up in their environments to understand which bugs could impact their security.
We firmly believe that, even though unfortunately it is often not regarded as common practice in our industry, being as transparent as possible about vulnerabilities, no matter how minor, is of crucial importance. At AIL Project, we care about the security of our users and prefer to have a high number of published CVEs rather than sweeping some of them under the rug.