Skip to content

Update Security Policy with new supported Versions and Update Advisory Publishing Process #3235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Weltraumschaf merged 4 commits into from
Aug 29, 2025
Merged

Update Security Policy with new supported Versions and Update Advisory Publishing Process #3235

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b0bbc26
Update supported versions in security policy
J12934 Aug 25, 2025
e96931d
Improve spelling and formatting
J12934 Aug 25, 2025
11d8983
Update the vulnerability reporting process to use the Github
J12934 Aug 25, 2025
e667bf0
Update normal release cycle
J12934 Aug 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 19 additions & 12 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,35 +7,42 @@ SPDX-License-Identifier: Apache-2.0
# Security Policy

## Supported Versions

Our _release cycle_ for new features (minor [semver](https://semver.org/) update)
is roughly every two weeks (we will usually make a new release after each review).
is roughly every four weeks (we will usually make a new release after each sprint review).

| Version | Security Fixes* | Supported** |
| ------- | ------------------ | ------------------ |
| 4.x.x | :white_check_mark: | :white_check_mark: |
| 3.15.x | :white_check_mark: | :white_check_mark: |
| <= 2.9.x | :x: | :x: |
| < 2.0 | :x: | :x: |
| 5.x.x | :white_check_mark: | :white_check_mark: |
| 4.16.x | Critical issues only | :x: |
| <= 3.15.x | :x: | :x: |

### Major Release (Semver)

_Upcoming major updates_ will come with a time window in which both _major versions_ (starting with v2.x.x)
will receive security updates and bugfixes. The concrete support intervall will be probably a couple of months
and will be published when the next major version will be released.
will receive security updates and bugfixes. The concrete support interval will probably be a couple of months
and will be published when the next major version is released.

### Minor Release/Feature Releases (Semver)

We currently plan to provide support for the _latest minor [semver](https://semver.org/)_ release only.

### Patch Release/Bugfix/Security Fix

We try to make bugfixes and high severity fixes available as patch release for the current minor release
as early as possible.

## Extended (Enterprise) Support
If you are interested in extended support for older versions with security updates of our project

If you are interested in extended support for older versions with security updates of our project
please get in touch with the project team via Slack or email <secureCodeBox@iteratec.com>.

## Reporting a Vulnerability
You have found a vulnerability in the project that shouldn't be disclosed as public issue before it's fixed?
Please get in touch with the project team via Slack or email <secureCodeBox@iteratec.com>.

You can expect a fast reaction within the next days.
We will keep you updated about the next steps and inform you if the vulnerability is accepted and when its fixed or if its ordeclined somehow.
You have found a vulnerability in the project that shouldn't be disclosed as a public issue before it's fixed?
Please report it using GitHub Security Advisories at https://github.com/secureCodeBox/secureCodeBox/security/advisories.

If you are unable to use GitHub advisories, please email the project leaders at their OWASP email addresses that can be found under https://github.com/OWASP/www-project-securecodebox/blob/master/leaders.md.

You can expect a fast reaction within the next few days.
We will keep you updated about the next steps and inform you if the vulnerability is accepted and when it's fixed or if it's declined somehow.
Loading