|
2 | 2 |
|
3 | 3 | ## Supported Versions |
4 | 4 |
|
5 | | -Use this section to tell people about which versions of your project are currently being supported with security updates. |
| 5 | +We maintain security updates for the following versions: |
6 | 6 |
|
7 | 7 | | Version | Supported | |
8 | 8 | | ------- | ------------------ | |
9 | | -| 1.0.3 | :white_check_mark: | |
10 | | -| 1.0.2 | :white_check_mark: | |
11 | | -| 1.0.1 | :x: | |
| 9 | +| 2.0.x | :white_check_mark: | |
| 10 | +| 1.0.x | :white_check_mark: | |
| 11 | +| < 1.0 | :x: | |
12 | 12 |
|
13 | | -## Reporting a Security Vulnerability |
| 13 | +## Reporting a Vulnerability |
14 | 14 |
|
15 | | -We take the security of Docker Safe Shutdown seriously. If you believe you have found a security vulnerability, please report it to us as described below. |
| 15 | +We take the security of our Docker container management tools seriously. If you discover a security vulnerability, please follow these steps: |
16 | 16 |
|
17 | | -**Please do not report security vulnerabilities through public GitHub issues.** |
| 17 | +1. **Do Not** create a public GitHub issue for the vulnerability. |
| 18 | +2. Submit your findings through one of these channels: |
| 19 | + - Open a [Security Advisory](https://github.com/PeterVinter/Manage_linux_docker_containers/security/advisories/new) |
| 20 | + - Email the maintainers at peter.vinter.security@gmail.com |
18 | 21 |
|
19 | | -Instead, please report them via email to [security@petervinter.com] or open a private security advisory at https://github.com/PeterVinter/docker-safe-shutdown/security/advisories/new |
| 22 | +We follow the principles of [Responsible Disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure). |
20 | 23 |
|
21 | | -You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message. |
| 24 | +### What to Include |
22 | 25 |
|
23 | | -Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue: |
| 26 | +When reporting a vulnerability, please include: |
24 | 27 |
|
25 | | -* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) |
26 | | -* Full paths of source file(s) related to the manifestation of the issue |
27 | | -* The location of the affected source code (tag/branch/commit or direct URL) |
28 | | -* Any special configuration required to reproduce the issue |
29 | | -* Step-by-step instructions to reproduce the issue |
30 | | -* Proof-of-concept or exploit code (if possible) |
31 | | -* Impact of the issue, including how an attacker might exploit the issue |
| 28 | +- A brief description of the vulnerability |
| 29 | +- Steps to reproduce the issue |
| 30 | +- Potential impact |
| 31 | +- Any suggested fixes (if available) |
32 | 32 |
|
33 | | -This information will help us triage your report more quickly. |
| 33 | +### Our Commitment |
34 | 34 |
|
35 | | -## Preferred Languages |
36 | | - |
37 | | -We prefer all communications to be in English. |
38 | | - |
39 | | -## Policy |
40 | | - |
41 | | -We follow the principle of [Responsible Disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure). |
| 35 | +- We will acknowledge receipt within 48 hours |
| 36 | +- We will provide regular updates on our progress |
| 37 | +- We will notify you when the vulnerability is fixed |
| 38 | +- We will publicly acknowledge your responsible disclosure (unless you prefer to remain anonymous) |
0 commit comments