Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add rules for known vulnerabilites #3

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+12 −1
Open

Add rules for known vulnerabilites #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion POLICY.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ reports one of the following problems:
- The vulnerability can be used to manipulate data within the service.
- XSS, CSRF, RCE, authentication/authorization bypass, SQL inections,
etc are considered relevant.
- Known vulnerabilities with a CVSS score greater than 7 that have not
yet been patched by the vendor and should therefore be mitigated by
other means until the patch is released and installed.

We will consider a vulnerability report most likely as NOT relevant if
it reports one of the following problems:
Expand All @@ -34,6 +37,8 @@ it reports one of the following problems:
- Publicly accessible version strings of used software.
- Security vulnerablities that can only be used within the scope of the
used account.
- The vulnerability exists in a third party software and is already
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would exclude about everything. What about something along the lines of:

  • The vulnerability is known and has a CVSS score less than 7
  • Deviations from best practices or common configuration that do not have a direct security impact

known.

4. Reporting Vulnerabilities

Expand All @@ -44,14 +49,20 @@ Please make sure that you include the following information:
- Which service is affected
- How can the bug be used/exploited
- Explanation of the risk
- If possible, include a estimated CVSS score

Reports will be answered within 48 hours. If you have not received an
answer within that time frame, feel free to contact us again.
answer within that time frame, feel free to contact us again. Please do
not ask for updates on a ticket repeatedly as it may take time to
resolve the issue.

For used open source software, we recommend to file bug reports and/or
pull requests against the upstream repositories. This includes hardening
instructions in the installation documentation.

If you are reporting a known vulnerability, please include a reference
to the original vulnerability report.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

... and/or a CVE number.

Please stick to the methods defined out in the Common Vulnerability Scoring System (CVSS) for defining the criticality of a vulnerability.


5. Bug Bounties / Vulnerability Rewards

The amount of the reward payed depends on the severity of the found
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only responsible disclosures and reports adhering to this policy are eligible for a reward.

Expand Down