Add SECURITY.md (responsible disclosure policy) — DevOps hygiene
Browse files- SECURITY.md +38 -0
SECURITY.md
ADDED
|
@@ -0,0 +1,38 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
# Security Policy
|
| 2 |
+
|
| 3 |
+
## Reporting a Vulnerability
|
| 4 |
+
|
| 5 |
+
**Do NOT open a public issue for security vulnerabilities.**
|
| 6 |
+
|
| 7 |
+
Please report security vulnerabilities via email to **security@szlholdings.ai** with:
|
| 8 |
+
|
| 9 |
+
1. Description of the vulnerability
|
| 10 |
+
2. Steps to reproduce
|
| 11 |
+
3. Potential impact assessment
|
| 12 |
+
4. Any suggested mitigations
|
| 13 |
+
|
| 14 |
+
### Response SLA
|
| 15 |
+
|
| 16 |
+
| Severity | Initial Response | Resolution Target |
|
| 17 |
+
|---|---|---|
|
| 18 |
+
| Critical | 24 hours | 7 days |
|
| 19 |
+
| High | 48 hours | 30 days |
|
| 20 |
+
| Medium | 5 business days | 90 days |
|
| 21 |
+
| Low | 10 business days | 180 days |
|
| 22 |
+
|
| 23 |
+
We follow a **90-day responsible disclosure** policy.
|
| 24 |
+
|
| 25 |
+
## Supply-Chain Security
|
| 26 |
+
|
| 27 |
+
- **SLSA Build Level 1** — build provenance generated per release (honest; not L2/L3)
|
| 28 |
+
- **DCO required** — all commits carry `Signed-off-by:` trailers per [Linux Foundation DCO](https://developercertificate.org/)
|
| 29 |
+
- **Cosign keyless signing** — verify with `cosign verify ghcr.io/szl-holdings/szl-blocked:<tag>`
|
| 30 |
+
- **SBOM** — CycloneDX SBOM attached to each release
|
| 31 |
+
|
| 32 |
+
## Contact
|
| 33 |
+
|
| 34 |
+
- **Security disclosures:** security@szlholdings.ai
|
| 35 |
+
- **General:** hello@szlholdings.ai
|
| 36 |
+
- **Website:** https://szlholdings.ai
|
| 37 |
+
|
| 38 |
+
*This policy follows the [OpenSSF Vulnerability Disclosure Guide](https://github.com/ossf/oss-vulnerability-guide).*
|