tauri-apps/tauri
1
1
Fork 0
mirror of https://github.com/tauri-apps/tauri.git synced 2024-11-30 18:46:27 +03:00
Code Issues Packages Projects Releases Wiki Activity

Added GitHub disclosure process (#5905)

Browse Source
This commit is contained in:
tweidinger 2022-12-27 07:01:45 +09:00 committed by GitHub
parent d17027e1a0
commit f5305de251
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
SECURITY.md
View File

@ -13,7 +13,16 @@ If you have found a potential security threat, vulnerability or exploit in Tauri
or one of its upstream dependencies, please DON’T create a pull-request, DON’T
file an issue on GitHub, DON’T mention it on Discord and DON’T create a forum thread.
We will be adding contact information to this page very soon.
Please submit your report via the GitHub Private Vulnerability Disclosure functionality.
Find out more about the reporting process [here](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
Our team will triage your report and keep you informed about the progress.
We may ask questions or request further guidance on reproduction of the vulnerability in the comments of the advisory, which will be publicized.
Additionally, we may ask you to independently verify our patch, which will be available in the private advisory branch. Please do not publish your vulnerability during the process or before coordinated public disclosure from our side. We try to adhere to common standards of publication within 90-Days of disclosure.
Depending on your decision to accept or deny credit for the vulnerability, you will be publicly attributed to the vulnerability and may be mentioned in our announcements.
At the current time we do not have the financial ability to reward bounties,
but in extreme cases will at our discretion consider a reward.