diff --git a/SECURITY.md b/SECURITY.md index 1543753..55a5483 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,94 +1,30 @@ -# Notices for Eclipse Thingweb +# Security Policy -This content is produced and maintained by the Eclipse Thingweb project. +This Eclipse Foundation Project adheres to the [Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/). -- Project home: https://projects.eclipse.org/projects/iot.thingweb +## How To Report a Vulnerability -## Trademarks +If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure. -Eclipse Thingweb is a trademark of the Eclipse Foundation. +**Please do not report security vulnerabilities through public issues, discussions, or change requests.** -## Copyright +Instead, report it using one of the following ways: -All content is the property of the respective authors or their employers. For -more information regarding authorship of content, please consult the listed -source code repository logs. +- Create a [confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/new?issuable_template=new_vulnerability) in the Eclipse Foundation Vulnerability Reporting Tracker +- Report a [vulnerability](https://github.com/eclipse-thingweb/website/security/advisories/new) directly via private vulnerability reporting on GitHub -Note: The {year} in the copyright statements is the year in which the content -was created (e.g. “2004”). A range of years is not used. +You can find more information about reporting and disclosure at the [Eclipse Foundation Security page](https://www.eclipse.org/security/). -## Declared Project Licenses +Please include as much of the information listed below as you can to help us better understand and resolve the issue: -This program and the accompanying materials are made available under the terms -of the Eclipse Public License v. 2.0 which is available at -http://www.eclipse.org/legal/epl-2.0, or the W3C Software Notice and Document -License (2015-05-13) which is available at -https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document. +- The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) +- Affected version(s) +- Impact of the issue, including how an attacker might exploit the issue +- Step-by-step instructions to reproduce the issue +- The location of the affected source code (tag/branch/commit or direct URL) +- Full paths of source file(s) related to the manifestation of the issue +- Configuration required to reproduce the issue +- Log files that are related to this issue (if possible) +- Proof-of-concept or exploit code (if possible) -SPDX-License-Identifier: EPL-2.0 OR W3C-20150513 - -## Source Code - -The project maintains the following source code repositories: - -## Third-party Content - -## Cryptography - -Content may contain encryption software. The country in which you are currently -may have restrictions on the import, possession, and use, and/or re-export to -another country, of encryption software. BEFORE using any encryption software, -please check the country's laws, regulations and policies concerning the import, -possession, or use, and re-export of encryption software, to see if this is -permitted. - - - -_ISO 27005 defines vulnerability as: -"A weakness of an asset or group of assets that can be exploited by one or more threats."_ - -## The Eclipse Security Team - -The Eclipse Security Team provides help and advice to Eclipse projects -on vulnerability issues and is the first point of contact -for handling security vulnerabilities. -Members of the Security Team are committers on Eclipse Projects -and members of the Eclipse Architecture Council. - -Contact the [Eclipse Security Team](mailto:security@eclipse.org). - -**Note that, as a matter of policy, the security team does not open attachments.** - -## Reporting a Security Vulnerability - -Vulnerabilities can be reported either via email to the Eclipse Security Team -or directly with a project via the Eclipse Foundation's Bugzilla instance. - -The general security mailing list address is security@eclipse.org. -Members of the Eclipse Security Team will receive messages sent to this address. -This address should be used only for reporting undisclosed vulnerabilities; -regular issue reports and questions unrelated to vulnerabilities in Eclipse software -will be ignored. -Note that this email address is not encrypted. - -The community is also encouraged to report vulnerabilities using the -[Eclipse Foundation's Bugzilla instance](https://bugs.eclipse.org/bugs/enter_bug.cgi?product=Community&component=Vulnerability%20Reports&keywords=security&groups=Security_Advisories). -Note that you will require an Eclipse Foundation account to create an issue report, -but by doing so you will be able to participate directly in the resolution of the issue. - -Issue reports related to vulnerabilities must be marked as "committers-only", -either automatically by clicking the provided link, by the reporter, -or by a committer during the triage process. -Note that issues marked "committers-only" are visible to all Eclipse committers. -By default, a "committers-only" issue is also accessible to the reporter -and individuals explicitly indicated in the "cc" list. - -## Disclosure - -Disclosure is initially limited to the reporter and all Eclipse Committers, -but is expanded to include other individuals, and the general public. -The timing and manner of disclosure is governed by the -[Eclipse Security Policy](https://www.eclipse.org/security/policy.php). - -Publicly disclosed issues are listed on the -[Disclosed Vulnerabilities Page](https://www.eclipse.org/security/known.php). +This information will help us triage your report more quickly.