From b549e6c3836bd517e9a009f8634d006bfc0be569 Mon Sep 17 00:00:00 2001 From: Lukas Javorsky Date: Tue, 25 Aug 2026 11:26:26 +0200 Subject: [PATCH] Add SECURITY.md based on CRA template Organization-wide security reporting file adapted from RedHatProductSecurity/CRA SECURITY.md template. Sets osbuilders@redhat.com as contact, lists supported project release pages, and includes EU CRA steward statement. --- SECURITY.md | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..eb4f926 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,52 @@ +# Reporting a Security Vulnerability or Incident + +Please do not report security vulnerabilities or security incidents via public channels (such as GitHub Issues or Pull Requests). To ensure coordinated disclosure, submit your findings via email to: `osbuilders@redhat.com` + +## Submission Guidelines + +To help us triage and resolve the issue efficiently, please include the following in your report: + +- **Title**: A concise, descriptive summary of the issue. +- **Reporter Details**: Your name/handle and affiliation. +- **Technical Description**: Detailed information regarding the vulnerability. +- **Affected Versions**: The specific version(s) or range(s) of software tested. +- **Reproduction Steps**: A minimal, functional example to reproduce the issue. +- **Impact Assessment**: Potential exploit scenarios and perceived severity (optional). +- **Suggested Fix**: Any proposed patches or mitigations (optional). +- **Disclosure Status**: Whether this has been shared with other parties or published and your plan for future sharing (e.g., at a conference). + +## Response Timeline + +We aim to provide an initial acknowledgement of your report within 3 business days. + +Our goal is to assess the report, coordinate fix and disclosure as quickly as possible. All confirmed security vulnerabilities and incidents will be addressed according to severity level and impact on the project. + +## Contact Information + +Direct all security questions and vulnerability reports to: + +- **Email**: [osbuilders@redhat.com](mailto:osbuilders@redhat.com) + +## Security Policy + +For the full vulnerability management and incident response policy, see the [Image Builder Security documentation](https://osbuild.org/docs/security/00-index). + +## Supported Versions + +We regularly perform patch releases for the supported latest versions, which contain fixes for relevant security vulnerabilities and important bugs. Prior releases might receive critical security fixes on a best-effort basis. However, we cannot guarantee that security fixes will get back-ported to unsupported versions. + +Refer to each project's release page for the latest version: + +- [osbuild](https://github.com/osbuild/osbuild/releases) +- [osbuild-composer](https://github.com/osbuild/osbuild-composer/releases) +- [images](https://github.com/osbuild/images/releases) +- [bootc-image-builder](https://github.com/osbuild/bootc-image-builder/releases) + +## EU Cyber Resilience Act — Open Source Steward Statement + +This project is stewarded by **Red Hat, Inc.**, an open source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng). +Contact: [cra-steward@redhat.com](mailto:cra-steward@redhat.com) + +For guidance on reporting actively exploited vulnerabilities and severe incidents under the CRA, see [Reporting Actively Exploited Vulnerabilities and Severe Incidents](https://github.com/RedHatProductSecurity/CRA/blob/main/Guidelines/eu-cra-incident-and-vulnerability-reporting-guidelines.md). + +Refer to [Red Hat's security practices and vulnerability management policy](https://access.redhat.com/security/) for detailed information.