Skip to content

Update SECURITY.md #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
FortiShield wants to merge 1 commit into from
Closed

Update SECURITY.md #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 8 additions & 20 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,27 +2,15 @@

## Reporting a Vulnerability

If you discover a vulnerability in any of our projects, please follow these steps:
If you discover a security issue, please report it responsibly via [GitHub Security Advisories](https://docs.github.com/en/code-security/security-advisories) or email security@yourdomain.com.

1. **Do not disclose the vulnerability publicly** until it has been resolved.
2. **Contact us directly** at [security@khulnasoft.com](mailto:security@khulnasoft.com). Please include the following information in your report:
- A description of the vulnerability
- Steps to reproduce or a proof of concept (PoC)
- Any relevant system/environment details (e.g., OS version, software version)
3. **We will acknowledge receipt** of your report and work with you to resolve the issue.
4. Once resolved, the vulnerability will be disclosed publicly, with appropriate credit given.
## Security Roles

## Responsible Disclosure
- Security Maintainers: @username1, @username2
- Pentesters: @username3

We take security very seriously. Any security issue discovered should be reported directly to us, and we will ensure that the issue is patched and disclosed responsibly. By following this process, you help protect the integrity of this project and its users.
## Security Practices

## Vulnerability Disclosure Timeline

- **Day 0**: Vulnerability report received.
- **Day 1–3**: Acknowledgment and preliminary assessment.
- **Day 4–14**: Fix development and testing.
- **Day 15**: Public disclosure (with fixes) and credit given.

Please **do not** use the tools or exploits provided here to attack unauthorized systems. Follow legal guidelines in your local jurisdiction when testing systems.

Thank you for helping us keep our projects secure!
- Code review required for all merges.
- Automated security scanning in CI/CD.
- Regular dependency updates and audits.