@@ -0,0 +1,49 @@
1+---
2+id: security
3+title: Security
4+---
5+
6+:::note
7+OAuth2 Proxy is a community project.
8+Maintainers do not work on this project full time, and as such,
9+while we endeavour to respond to disclosures as quickly as possible,
10+this may take longer than in projects with corporate sponsorship.
11+:::
12+
13+## Security Disclosures
14+
15+:::important
16+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
17+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post any
18+details publicly.
19+:::
20+
21+Security disclosures MUST be done in private.
22+If you have found an issue that you would like to bring to the attention of the
23+maintenance team for OAuth2 Proxy, please compose an email and send it to the
24+list of maintainers in our [MAINTAINERS](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS) file.
25+
26+Please include as much detail as possible.
27+Ideally, your disclosure should include:
28+- A reproducible case that can be used to demonstrate the exploit
29+- How you discovered this vulnerability
30+- A potential fix for the issue (if you have thought of one)
31+- Versions affected (if not present in master)
32+- Your GitHub ID
33+
34+### How will we respond to disclosures?
35+
36+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
37+to privately discuss fixes for disclosed vulnerabilities.
38+If you include a GitHub ID with your disclosure we will add you as a collaborator
39+for the advisory so that you can join the discussion and validate any fixes
40+we may propose.
41+
42+For minor issues and previously disclosed vulnerabilities (typically for
43+dependencies), we may use regular PRs for fixes and forego the security advisory.
44+
45+Once a fix has been agreed upon, we will merge the fix and create a new release.
46+If we have multiple security issues in flight simultaneously, we may delay
47+merging fixes until all patches are ready.
48+We may also backport the fix to previous releases,
49+but this will be at the discretion of the maintainers.