From b0bbc2666c2ec8729d207e10eade8233e22397f8 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 25 Aug 2025 16:59:07 +0200 Subject: [PATCH 1/4] Update supported versions in security policy Signed-off-by: Jannik Hollenbach --- SECURITY.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f30ec54ff9..030a2aef53 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,10 +12,9 @@ is roughly every two weeks (we will usually make a new release after each review | Version | Security Fixes* | Supported** | | ------- | ------------------ | ------------------ | -| 4.x.x | :white_check_mark: | :white_check_mark: | -| 3.15.x | :white_check_mark: | :white_check_mark: | -| <= 2.9.x | :x: | :x: | -| < 2.0 | :x: | :x: | +| 5.x.x | :white_check_mark: | :white_check_mark: | +| 4.16.x | Critical issues only | :x: | +| <= 3.15.x | :x: | :x: | ### Major Release (Semver) _Upcoming major updates_ will come with a time window in which both _major versions_ (starting with v2.x.x) From e96931d4a8626bafb28051b867678e620dcf0b3c Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 25 Aug 2025 17:01:04 +0200 Subject: [PATCH 2/4] Improve spelling and formatting Signed-off-by: Jannik Hollenbach --- SECURITY.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 030a2aef53..0fe6afaaa4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,8 +7,9 @@ SPDX-License-Identifier: Apache-2.0 # Security Policy ## Supported Versions + Our _release cycle_ for new features (minor [semver](https://semver.org/) update) -is roughly every two weeks (we will usually make a new release after each review). +is roughly every two weeks (we will usually make a new release after each review). | Version | Security Fixes* | Supported** | | ------- | ------------------ | ------------------ | @@ -17,24 +18,29 @@ is roughly every two weeks (we will usually make a new release after each review | <= 3.15.x | :x: | :x: | ### Major Release (Semver) + _Upcoming major updates_ will come with a time window in which both _major versions_ (starting with v2.x.x) -will receive security updates and bugfixes. The concrete support intervall will be probably a couple of months -and will be published when the next major version will be released. +will receive security updates and bugfixes. The concrete support interval will probably be a couple of months +and will be published when the next major version is released. ### Minor Release/Feature Releases (Semver) + We currently plan to provide support for the _latest minor [semver](https://semver.org/)_ release only. ### Patch Release/Bugfix/Security Fix + We try to make bugfixes and high severity fixes available as patch release for the current minor release as early as possible. ## Extended (Enterprise) Support -If you are interested in extended support for older versions with security updates of our project + +If you are interested in extended support for older versions with security updates of our project please get in touch with the project team via Slack or email . ## Reporting a Vulnerability + You have found a vulnerability in the project that shouldn't be disclosed as public issue before it's fixed? -Please get in touch with the project team via Slack or email . +Please get in touch with the project team via Slack or email . -You can expect a fast reaction within the next days. -We will keep you updated about the next steps and inform you if the vulnerability is accepted and when its fixed or if its ordeclined somehow. +You can expect a fast reaction within the next few days. +We will keep you updated about the next steps and inform you if the vulnerability is accepted and when it's fixed or if it's declined somehow. From 11d898322527ac2a60c02f6b50cb904eb2266245 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 25 Aug 2025 17:04:09 +0200 Subject: [PATCH 3/4] Update the vulnerability reporting process to use the Github Vulnerability advisories instead of a company specific mail address. Signed-off-by: Jannik Hollenbach --- SECURITY.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0fe6afaaa4..86e45af980 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -39,8 +39,10 @@ please get in touch with the project team via Slack or email . +You have found a vulnerability in the project that shouldn't be disclosed as a public issue before it's fixed? +Please report it using GitHub Security Advisories at https://github.com/secureCodeBox/secureCodeBox/security/advisories. + +If you are unable to use GitHub advisories, please email the project leaders at their OWASP email addresses that can be found under https://github.com/OWASP/www-project-securecodebox/blob/master/leaders.md. You can expect a fast reaction within the next few days. We will keep you updated about the next steps and inform you if the vulnerability is accepted and when it's fixed or if it's declined somehow. From e667bf0dae876bc9c901fba3c2caeb641f54878f Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 27 Aug 2025 16:54:10 +0200 Subject: [PATCH 4/4] Update normal release cycle Co-authored-by: Sven Strittmatter Signed-off-by: Jannik Hollenbach --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 86e45af980..20ffb4cf4f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -9,7 +9,7 @@ SPDX-License-Identifier: Apache-2.0 ## Supported Versions Our _release cycle_ for new features (minor [semver](https://semver.org/) update) -is roughly every two weeks (we will usually make a new release after each review). +is roughly every four weeks (we will usually make a new release after each sprint review). | Version | Security Fixes* | Supported** | | ------- | ------------------ | ------------------ |