== Security Policy TEMPLATE INSTRUCTIONS (delete this block before publishing) Replace all \{\{PLACEHOLDER}} values with your information: Squisher Corpus - Your project name hyperpolymath - GitHub username or org (e.g., hyperpolymath) squisher-corpus - Repository name j.d.a.jewell@open.ac.uk - Security contact email TBD - Your PGP key fingerprint (40 chars, no spaces) https://github.com/hyperpolymath.gpg - URL to your public PGP key github.com/hyperpolymath/squisher-corpus - Your website/domain 2026 - Current year for copyright Optional: Remove sections that don’t apply (e.g., PGP if you don’t use it) –> We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. === Table of Contents * link:#reporting-a-vulnerability[Reporting a Vulnerability] * link:#what-to-include[What to Include] * link:#response-timeline[Response Timeline] * link:#disclosure-policy[Disclosure Policy] * link:#scope[Scope] * link:#safe-harbour[Safe Harbour] * link:#recognition[Recognition] * link:#security-updates[Security Updates] * link:#security-best-practices[Security Best Practices] ''''' === Reporting a Vulnerability ==== Preferred Method: GitHub Security Advisories The preferred method for reporting security vulnerabilities is through GitHub’s Security Advisory feature: [arabic] . Navigate to https://github.com/hyperpolymath/network-outpost/security/advisories/new[Report a Vulnerability] . Click *"`Report a vulnerability`"* . Complete the form with as much detail as possible . Submit — we’ll receive a private notification This method ensures: * End-to-end encryption of your report * Private discussion space for collaboration * Coordinated disclosure tooling * Automatic credit when the advisory is published ==== Alternative: Encrypted Email If you cannot use GitHub Security Advisories, you may email us directly: [width="100%",cols="50%,50%",] |=== |*Email* |j.d.a.jewell@open.ac.uk |*PGP Key* |https://github.com/hyperpolymath.gpg[Download Public Key] |*Fingerprint* |`+TBD+` |=== [source,bash] ---- # Import our PGP key curl -sSL https://github.com/hyperpolymath.gpg | gpg --import # Verify fingerprint gpg --fingerprint j.d.a.jewell@open.ac.uk # Encrypt your report gpg --armor --encrypt --recipient j.d.a.jewell@open.ac.uk report.txt ---- ____ *⚠️ Important:* Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. ____ ''''' === What to Include A good vulnerability report helps us understand and reproduce the issue quickly. ==== Required Information * *Description*: Clear explanation of the vulnerability * *Impact*: What an attacker could achieve (confidentiality, integrity, availability) * *Affected versions*: Which versions/commits are affected * *Reproduction steps*: Detailed steps to reproduce the issue ==== Helpful Additional Information * *Proof of concept*: Code, scripts, or screenshots demonstrating the vulnerability * *Attack scenario*: Realistic attack scenario showing exploitability * *CVSS score*: Your assessment of severity (use https://www.first.org/cvss/calculator/3.1[CVSS 3.1 Calculator]) * *CWE ID*: Common Weakness Enumeration identifier if known * *Suggested fix*: If you have ideas for remediation * *References*: Links to related vulnerabilities, research, or advisories ==== Example Report Structure [source,markdown] ---- ## Summary [One-sentence description of the vulnerability] ## Vulnerability Type [e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] ## Affected Component [File path, function name, API endpoint, etc.] ## Affected Versions [Version range or specific commits] ## Severity Assessment - CVSS 3.1 Score: [X.X] - CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] ## Description [Detailed technical description] ## Steps to Reproduce 1. [First step] 2. [Second step] 3. [...] ## Proof of Concept [Code, curl commands, screenshots, etc.] ## Impact [What can an attacker achieve?] ## Suggested Remediation [Optional: your ideas for fixing] ## References [Links to related issues, CVEs, research] ---- ''''' === Response Timeline We commit to the following response times: [width="100%",cols="24%,35%,41%",options="header",] |=== |Stage |Timeframe |Description |*Initial Response* |48 hours |We acknowledge receipt and confirm we’re investigating |*Triage* |7 days |We assess severity, confirm the vulnerability, and estimate timeline |*Status Update* |Every 7 days |Regular updates on remediation progress |*Resolution* |90 days |Target for fix development and release (complex issues may take longer) |*Disclosure* |90 days |Public disclosure after fix is available (coordinated with you) |=== ____ *Note:* These are targets, not guarantees. Complex vulnerabilities may require more time. We’ll communicate openly about any delays. ____ ''''' === Disclosure Policy We follow *coordinated disclosure* (also known as responsible disclosure): [arabic] . *You report* the vulnerability privately . *We acknowledge* and begin investigation . *We develop* a fix and prepare a release . *We coordinate* disclosure timing with you . *We publish* security advisory and fix simultaneously . *You may publish* your research after disclosure ==== Our Commitments * We will not take legal action against researchers who follow this policy * We will work with you to understand and resolve the issue * We will credit you in the security advisory (unless you prefer anonymity) * We will notify you before public disclosure * We will publish advisories with sufficient detail for users to assess risk ==== Your Commitments * Report vulnerabilities promptly after discovery * Give us reasonable time to address the issue before disclosure * Do not access, modify, or delete data beyond what’s necessary to demonstrate the vulnerability * Do not degrade service availability (no DoS testing on production) * Do not share vulnerability details with others until coordinated disclosure ==== Disclosure Timeline .... Day 0 You report vulnerability Day 1-2 We acknowledge receipt Day 7 We confirm vulnerability and share initial assessment Day 7-90 We develop and test fix Day 90 Coordinated public disclosure (earlier if fix is ready; later by mutual agreement) .... If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. ''''' === Scope ==== In Scope ✅ The following are within scope for security research: * This repository (`+hyperpolymath/network-outpost+`) and all its code * Official releases and packages published from this repository * Documentation that could lead to security issues * Build and deployment configurations in this repository * Dependencies (report here, we’ll coordinate with upstream) ==== Out of Scope ❌ The following are *not* in scope: * Third-party services we integrate with (report directly to them) * Social engineering attacks against maintainers * Physical security * Denial of service attacks against production infrastructure * Spam, phishing, or other non-technical attacks * Issues already reported or publicly known * Theoretical vulnerabilities without proof of concept ==== Qualifying Vulnerabilities We’re particularly interested in: * Remote code execution * SQL injection, command injection, code injection * Authentication/authorisation bypass * Cross-site scripting (XSS) and cross-site request forgery (CSRF) * Server-side request forgery (SSRF) * Path traversal / local file inclusion * Information disclosure (credentials, PII, secrets) * Cryptographic weaknesses * Deserialisation vulnerabilities * Memory safety issues (buffer overflows, use-after-free, etc.) * Supply chain vulnerabilities (dependency confusion, etc.) * Significant logic flaws ==== Non-Qualifying Issues The following generally do not qualify as security vulnerabilities: * Missing security headers on non-sensitive pages * Clickjacking on pages without sensitive actions * Self-XSS (requires victim to paste code) * Missing rate limiting (unless it enables a specific attack) * Username/email enumeration (unless high-risk context) * Missing cookie flags on non-sensitive cookies * Software version disclosure * Verbose error messages (unless exposing secrets) * Best practice deviations without demonstrable impact ''''' === Safe Harbour We support security research conducted in good faith. ==== Our Promise If you conduct security research in accordance with this policy: * ✅ We will not initiate legal action against you * ✅ We will not report your activity to law enforcement * ✅ We will work with you in good faith to resolve issues * ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws * ✅ We waive any potential claim against you for circumvention of security controls ==== Good Faith Requirements To qualify for safe harbour, you must: * Comply with this security policy * Report vulnerabilities promptly * Avoid privacy violations (do not access others’ data) * Avoid service degradation (no destructive testing) * Not exploit vulnerabilities beyond proof-of-concept * Not use vulnerabilities for profit (beyond bug bounties where offered) ____ *⚠️ Important:* This safe harbour does not extend to third-party systems. Always check their policies before testing. ____ ''''' === Recognition We believe in recognising security researchers who help us improve. ==== Hall of Fame Researchers who report valid vulnerabilities will be acknowledged in our link:SECURITY-ACKNOWLEDGMENTS.md[Security Acknowledgments] (unless they prefer anonymity). Recognition includes: * Your name (or chosen alias) * Link to your website/profile (optional) * Brief description of the vulnerability class * Date of report ==== What We Offer * ✅ Public credit in security advisories * ✅ Acknowledgment in release notes * ✅ Entry in our Hall of Fame * ✅ Reference/recommendation letter upon request (for significant findings) ==== What We Don’t Currently Offer * ❌ Monetary bug bounties * ❌ Hardware or swag * ❌ Paid security research contracts ____ *Note:* We’re a community project with limited resources. Your contributions help everyone who uses this software. ____ ''''' === Security Updates ==== Receiving Updates To stay informed about security updates: * *Watch this repository*: Click "`Watch`" → "`Custom`" → Select "`Security alerts`" * *GitHub Security Advisories*: Published at https://github.com/hyperpolymath/network-outpost/security/advisories[Security Advisories] * *Release notes*: Security fixes noted in link:CHANGELOG.md[CHANGELOG] ==== Update Policy [cols=",",options="header",] |=== |Severity |Response |*Critical/High* |Patch release as soon as fix is ready |*Medium* |Included in next scheduled release (or earlier) |*Low* |Included in next scheduled release |=== ==== Supported Versions [cols=",,",options="header",] |=== |Version |Supported |Notes |`+main+` branch |✅ Yes |Latest development |Latest release |✅ Yes |Current stable |Previous minor release |✅ Yes |Security fixes backported |Older versions |❌ No |Please upgrade |=== ''''' === Security Best Practices When using Network Outpost, we recommend: ==== General * Keep dependencies up to date * Use the latest stable release * Subscribe to security notifications * Review configuration against security documentation * Follow principle of least privilege ==== For Contributors * Never commit secrets, credentials, or API keys * Use signed commits (`+git config commit.gpgsign true+`) * Review dependencies before adding them * Run security linters locally before pushing * Report any concerns about existing code ''''' === Additional Resources * https://github.com/hyperpolymath.gpg[Our PGP Public Key] * https://github.com/hyperpolymath/network-outpost/security/advisories[Security Advisories] * link:CHANGELOG.md[Changelog] * link:CONTRIBUTING.md[Contributing Guidelines] * https://cve.mitre.org/[CVE Database] * https://www.first.org/cvss/calculator/3.1[CVSS Calculator] ''''' === Contact [width="100%",cols="50%,50%",options="header",] |=== |Purpose |Contact |*Security issues* |https://github.com/hyperpolymath/network-outpost/security/advisories/new[Report via GitHub] or j.d.a.jewell@open.ac.uk |*General questions* |https://github.com/hyperpolymath/network-outpost/discussions[GitHub Discussions] |*Other enquiries* |See link:README.md[README] for contact information |=== ''''' === Policy Changes This security policy may be updated from time to time. Significant changes will be: * Committed to this repository with a clear commit message * Noted in the changelog * Announced via GitHub Discussions (for major changes) ''''' _Thank you for helping keep Network Outpost and its users safe._ 🛡️ ''''' Last updated: 2026 · Policy version: 1.0.0