mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-08-04 06:16:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fill CNCF SECURITY.md gaps (contacts, bug bounty, embargo scope, notification template)

Browse Source 
Aligns SECURITY.md with CNCF's Security Guidelines for New Projects,
section 3 (contribute.cncf.io/projects/best-practices/security).

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
This commit is contained in:
Tiger Kaovilai
2026-07-21 13:17:32 -04:00
parent 0a806675df
commit 35427e4dbf
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+20 -1
View File
@@ -21,6 +21,11 @@ If you know of a publicly disclosed security vulnerability for Velero, please **
To report a vulnerability or a security-related issue, please contact the email address with the details of the vulnerability. The email will be fielded by the Security Team and then shared with the Velero maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/velero-io/velero/issues/new/choose) instead.
## Security Contacts
Reports sent to cncf-velero-security@lists.cncf.io are triaged by the Velero Security Team and shared with the [Velero maintainers](https://github.com/velero-io/velero/blob/main/MAINTAINERS.md), who hold committer and release permissions. Velero does not currently offer a bug bounty program.
## Proposed Email Content
Provide a descriptive subject line and in the body of the email include the following information:
@@ -75,6 +80,20 @@ The Security Team will also publish any mitigating steps users can take until th
## Security Notification Template
Pre-disclosure notifications (e.g. to the Velero Distributors mailing list) and public advisories will include, at minimum:
* Purpose and summary of the notification.
* Vulnerability name, along with its CVE identifier if one has been assigned.
* Affected versions of the project.
* Severity of the vulnerability.
* Proof of concept, where available.
* Mitigation or remediation steps, along with the fixed version(s).
* Timeline of events associated with the vulnerability.
* Any additional information relevant to the notification.
## Mailing lists
@@ -107,7 +126,7 @@ To be eligible to join the [Velero Distributors](https://groups.google.com/u/1/g
## Embargo Policy
The information that members receive on the Velero Distributors mailing list must not be made public, shared, or even hinted at anywhere beyond those who need to know within your specific team, unless you receive explicit approval to do so from the Security Team. This remains true until the public disclosure date/time agreed upon by the list. Members of the list and others cannot use the information for any reason other than to get the issue fixed for your respective distribution's users.
This embargo policy applies to everyone who receives vulnerability information ahead of public disclosure, including Security Team members, Velero maintainers, and Velero Distributors mailing list members. The information that members receive on the Velero Distributors mailing list must not be made public, shared, or even hinted at anywhere beyond those who need to know within your specific team, unless you receive explicit approval to do so from the Security Team. This remains true until the public disclosure date/time agreed upon by the list. Members of the list and others cannot use the information for any reason other than to get the issue fixed for your respective distribution's users.
Before you share any information from the list with members of your team who are required to fix the issue, these team members must agree to the same terms, and only be provided with information on a need-to-know basis.