You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: SECURITY.md
+22-4Lines changed: 22 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,12 +8,30 @@ This policy outlines the commitment and practices of the go-openapi maintainers
8
8
| ------- | ------------------ |
9
9
| 2.1.x |:white_check_mark:|
10
10
11
+
## Vulnerability checks in place
12
+
13
+
This repository uses automated vulnerability scans, at every merged commit and at least once a week.
14
+
15
+
We use:
16
+
17
+
*[`GitHub CodeQL`][codeql-url]
18
+
*[`trivy`][trivy-url]
19
+
*[`govulncheck`][govulncheck-url]
20
+
21
+
Reports are centralized in github security reports and visible only to the maintainers.
22
+
11
23
## Reporting a vulnerability
12
24
13
25
If you become aware of a security vulnerability that affects the current repository,
14
-
please report it privately to the maintainers.
26
+
**please report it privately to the maintainers**
27
+
rather than opening a publicly visible GitHub issue.
28
+
29
+
Please follow the instructions provided by github to [Privately report a security vulnerability][github-guidance-url].
15
30
16
-
Please follow the instructions provided by github to
17
-
[Privately report a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
31
+
> [!NOTE]
32
+
> On Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
18
33
19
-
TL;DR: on Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
0 commit comments