From 6a8ad8dc328bbc27250df6fdc83c409f0a2b0162 Mon Sep 17 00:00:00 2001 From: Stefanni Brasil Date: Fri, 18 Oct 2024 18:18:52 -0600 Subject: [PATCH 1/3] Create SECURITY.md following the template from Loofah: https://github.com/flavorjones/loofah/blob/main/SECURITY.md --- SECURITY.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..6d6f6df7bc --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,9 @@ +## Security and Vulnerability Reporting + +The faker-ruby core contributors take security very seriously and investigate all reported vulnerabilities. + +If you would like to report a vulnerablity or have a security concern regarding faker-ruby, please report it by contacting the current security coordinators (Stefanni Brasil stefanni@hexdevs.com and Thiago Araujo thd@hexdevs.com). + +The information you share with the faker-ruby core contributors as part of this process will be kept confidential within the team, unless or until we need to share information upstream with our dependent libraries' core teams, at which point we will notify you. + +If a vulnerability is first reported by you, we will credit you with the discovery in the public disclosure. From ca7c33602014b731c1aee9afc7f75ada9c85dca8 Mon Sep 17 00:00:00 2001 From: Stefanni Brasil Date: Fri, 18 Oct 2024 18:21:56 -0600 Subject: [PATCH 2/3] Update SECURITY.md --- SECURITY.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 6d6f6df7bc..5908471a3f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,12 @@ -## Security and Vulnerability Reporting +## Security Policy + +### Supported Versions + +Only the the latest version of this project is supported at a given time. If you find a security issue with an older version, please try updating to the latest version first. + +If for some reason you can't update to the latest version, please let us know your reasons so that we can have a better understanding of your situation. + +## Reporting a Vulnerability The faker-ruby core contributors take security very seriously and investigate all reported vulnerabilities. From f39b41db16e67583b3167403b6cc98394b879c8e Mon Sep 17 00:00:00 2001 From: Stefanni Brasil Date: Fri, 18 Oct 2024 18:22:32 -0600 Subject: [PATCH 3/3] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 5908471a3f..ffee60031a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,7 +10,7 @@ If for some reason you can't update to the latest version, please let us know yo The faker-ruby core contributors take security very seriously and investigate all reported vulnerabilities. -If you would like to report a vulnerablity or have a security concern regarding faker-ruby, please report it by contacting the current security coordinators (Stefanni Brasil stefanni@hexdevs.com and Thiago Araujo thd@hexdevs.com). +If you would like to report a vulnerablity or have a security concern regarding faker-ruby, please report it by contacting the current security coordinators (Stefanni Brasil stefanni@hexdevs.com and Thiago Araujo thiago@hexdevs.com). The information you share with the faker-ruby core contributors as part of this process will be kept confidential within the team, unless or until we need to share information upstream with our dependent libraries' core teams, at which point we will notify you.