mirror of
https://github.com/krkn-chaos/krkn.git
synced 2026-08-25 09:27:36 +00:00
Naga Ravi Chaitanya Elluri
0004c05f81
Functional & Unit Tests / Functional & Unit Tests (push) Failing after 8m15s
Functional & Unit Tests / Generate Coverage Badge (push) Has been skipped
This commit adds a policy on how Krkn follows best practices and addresses security vulnerabilities. Signed-off-by: Naga Ravi Chaitanya Elluri <nelluri@redhat.com>
44 lines
2.0 KiB
Markdown
44 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
We attach great importance to code security. We are very grateful to the users, security vulnerability researchers, etc. for reporting security vulnerabilities to the Krkn community. All reported security vulnerabilities will be carefully assessed and addressed in a timely manner.
|
|
|
|
|
|
## Security Checks
|
|
|
|
Krkn leverages [Snyk](https://snyk.io/) to ensure that any security vulnerabilities found
|
|
in the code base and dependencies are fixed and published in the latest release. Security
|
|
vulnerability checks are enabled for each pull request to enable developers to get insights
|
|
and proactively fix them.
|
|
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
The Krkn project treats security vulnerabilities seriously, so we
|
|
strive to take action quickly when required.
|
|
|
|
The project requests that security issues be disclosed in a responsible
|
|
manner to allow adequate time to respond. If a security issue or
|
|
vulnerability has been found, please disclose the details to our
|
|
dedicated email address:
|
|
|
|
cncf-krkn-maintainers@lists.cncf.io
|
|
|
|
You can also use the [GitHub vulnerability report mechanism](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability) to report the security vulnerability.
|
|
|
|
Please include as much information as possible with the report. The
|
|
following details assist with analysis efforts:
|
|
- Description of the vulnerability
|
|
- Affected component (version, commit, branch etc)
|
|
- Affected code (file path, line numbers)
|
|
- Exploit code
|
|
|
|
|
|
## Security Team
|
|
|
|
The security team currently consists of the [Maintainers of Krkn](https://github.com/krkn-chaos/krkn/blob/main/MAINTAINERS.md)
|
|
|
|
|
|
## Process and Supported Releases
|
|
|
|
The Krkn security team will investigate and provide a fix in a timely mannner depending on the severity. The fix will be included in the new release of Krkn and details will be included in the release notes.
|