Update SECURITY.md with a process #716
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alpe
reviewed
Jan 18, 2022
SECURITY.md
Outdated
| - Once a security report is received, the core development team works to verify the issue. | ||
| - Patches are prepared for eligible releases in private repositories. | ||
| - We notify the community that a security release is coming, to give users time to prepare their systems for the update. Notifications can include Discord messages, tweets, and emails to partners and validators. | ||
| - 24 hours following this notification, the fixes are applied publicly and new releases are issued. |
There was a problem hiding this comment.
We should be very sensible if this 24h make sense in our context. It may take much longer for chains to test and coordinate a software upgrade. They would be vulnerable within this period.
How would the advisories project fit into this process? It can be placed between patch and public announcement to give them some lead time.
Much of this was originally in CosmWasm/cw-plus#581
|
I think I addressed all concerns. Please let me know if there is more to do. |
ethanfrey
force-pushed
the
update-security-md
branch
from
11aa981
to
747a4ad
Compare
|
@webmaster128 can I get another review here? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add SECURITY text inspired by @elsehow
Much of this was originally in CosmWasm/cw-plus#581
Happy if @alpe and/or @webmaster128 can double check the process defined.