28 lines
1.6 KiB
Markdown
Vendored
28 lines
1.6 KiB
Markdown
Vendored
# Security Policy
|
|
|
|
## Prologue
|
|
|
|
We take security very seriously. We ask everyone follows the
|
|
[coordinated vulnerability disclosure model](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure), rather
|
|
than immediately making vulnerabilities public.
|
|
|
|
If you believe you have discovered a vulnerability please privately contact one of the
|
|
[maintainers](https://github.com/orgs/go-webauthn/teams/maintainers) via the contact methods on their GitHub profile. Alternatively you may [Report a Security Vulnerability](https://github.com/go-webauthn/webauthn/security/advisories/new) privately using the [GitHub Security Advisory Reporting beta](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability). In
|
|
the future we will publish an official email for this purpose.
|
|
|
|
## Credit
|
|
|
|
Users who report bugs will at the discretion of the user be credited for the discovery.
|
|
|
|
## Process
|
|
|
|
1. User privately reports a potential vulnerability.
|
|
2. The [maintainers](https://github.com/orgs/go-webauthn/people) review the report and ascertain if additional information is required.
|
|
3. The [maintainers](https://github.com/orgs/go-webauthn/people) reproduce the bug.
|
|
4. The bug is patched, and if possible the user reporting the bug is given access to a fixed version or git patch.
|
|
5. The fix is confirmed to resolve the vulnerability.
|
|
6. The fix is released.
|
|
7. The [security advisory] is published sometime after users have had a chance to update.
|
|
|
|
[security advisory]: https://github.com/go-webauthn/webauthn/security/advisories
|