Skip to content

Commit 18d2dfd

Browse files
authored
OTWO-7364 security md file added (#152)
Co-authored-by: Kumari Niharika <kumarin@blackduck.com>
1 parent a1e4d8a commit 18d2dfd

File tree

1 file changed

+30
-0
lines changed

1 file changed

+30
-0
lines changed

security.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
## Security
2+
The Black Duck Vulnerability Disclosure Process is executed by the Product Security Incident Response Team (PSIRT). The Black Duck process is based on well-known industry standards, such as NIST-SP-800-61, ISO 29147, and ISO 30111.
3+
4+
The Black Duck PSIRT coordinates the response and, if necessary, disclosure of security incidents related to Black Duck products and associated software. Black Duck PSIRT's primary objective is to minimize the risks associated with security incidents in a timely, secure, and responsible manner.
5+
6+
Black Duck will investigate all reports for Black Duck products/platforms that are currently supported; accepted reports will be prioritized based on severity and other environmental factors. 
7+
8+
If you believe you have found a security vulnerability in any repository that meets Black duck's definition of a security vulnerability, please report it to us as described below.
9+
10+
## Reporting Security Issues
11+
**Please do not report security vulnerabilities through public GitHub issues.**
12+
13+
Instead, please report them to the Black Duck PSIRT team through email psirt@blackduck.com.
14+
15+
Contact Black Duck within 24 hours if you encounter any end user data. Do not view, alter, save, store, transfer, or otherwise access the data, and immediately purge any local information upon reporting the vulnerability to Black Duck.
16+
17+
Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
18+
19+
- Affected Product/Platform and Version
20+
- Technical description of the issue
21+
- Detailed steps to reproduce and/or sample code used to exploit the vulnerability
22+
- Contact information and optional name for acknowledgments
23+
- Proposed disclosure plans
24+
This information will help us triage your report more quickly.
25+
26+
## Preferred Languages
27+
We prefer all communications to be in English.
28+
29+
## Policy
30+
Black Duck follows the principle of [Coordinated Vulnerability Disclosure.](https://www.blackduck.com/company/legal/vulnerability-disclosure-policy.html)

0 commit comments

Comments
 (0)