From d227d7b9d47a52a12fc6e94f9d5c7fca578c35e4 Mon Sep 17 00:00:00 2001 From: Marten Seemann Date: Thu, 6 Apr 2023 15:48:14 +0900 Subject: [PATCH] add a security policy (#2238) * add a security policy * fix typo * Update SECURITY.md --------- Co-authored-by: Prithvi Shahi <50885601+p-shahi@users.noreply.github.com> --- SECURITY.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..0ecad4301b --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,20 @@ +# Security Policy + +go-libp2p is still in development. This means that there may be problems in our protocols, +or there may be mistakes in our implementations. +We take security vulnerabilities very seriously. If you discover a security issue, +please bring it to our attention right away! + +## Reporting a Vulnerability + +If you find a vulnerability that may affect live deployments -- for example, by exposing +a remote execution exploit -- please [**report privately**](https://github.com/libp2p/go-libp2p/security/advisories/new). +Please **DO NOT file a public issue**. + +If the issue is an implementation weakness that cannot be immediately exploited or +something not yet deployed, just discuss it openly. +If you need assistance, please reach out to [security@libp2p.io](mailto:security@libp2p.io). + +## Reporting a non security bug + +For non-security bugs, please simply file a GitHub [issue](https://github.com/libp2p/go-libp2p/issues/new).