From 0fa627a278f7d66c75d8de5eab4f608043f092d6 Mon Sep 17 00:00:00 2001 From: Bloxster Date: Tue, 11 Aug 2026 10:12:56 +0200 Subject: [PATCH] docs: add a security policy and fix the reporting instructions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The repo has no SECURITY.md, so GitHub has no policy to surface, and the only security contact anywhere is a README line pointing at `security [at] torquem.ch` — the pre-rename domain. That leaves two paths that disagree: the private advisory channel is enabled and working but nobody is pointed to it, and the one written instruction points somewhere unverifiable. A test message to the torquem address went unanswered, so it is dropped rather than carried over. GitHub's private reporting is the sole documented route, which is the one channel confirmed to work. Whether to add an email fallback, and at which address, is left for maintainers to decide — a one-line addition once someone owns the mailbox. Advertising an address that did not answer a test would route reports into a void, which is the failure this change exists to fix. Shaped against the other clients' policies rather than written from scratch: Nethermind leads with the same GitHub-first route; Geth sends intake to the EF bounty instead; Reth is five lines of email address; Besu offers two tiered addresses. Deliberately skipped, because only Geth does them and both cost maintenance: an inline PGP key (redundant once the advisory channel is the primary route) and an audit-report table (Erigon has no external audits to publish). The supported-versions rule is stated as a rule rather than a version number so it doesn't go stale, which is more than any of the four commit to. Only `main` is touched: it is the default branch, so it backs both the repo landing page and the Security tab. release/3.5 and release/3.6 carry the same stale line and can pick up the fix in #22919 and the next backlog port. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 4 +++- SECURITY.md | 29 +++++++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 SECURITY.md diff --git a/README.md b/README.md index 3c9df0deb7b..3b253a12c80 100644 --- a/README.md +++ b/README.md @@ -205,7 +205,9 @@ Getting in touch ### Reporting security issues/concerns -Send an email to `security [at] torquem.ch`. +Report vulnerabilities privately via +[Security → Report a vulnerability](https://github.com/erigontech/erigon/security/advisories/new). +Please don't open a public issue for one — see [SECURITY.md](./SECURITY.md). ### Getting help diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000000..835b41f66b0 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,29 @@ +# Security Policy + +## Reporting a vulnerability + +**Please don't open a public issue for a security vulnerability** — a public report reaches attackers +before node operators have a fix to upgrade to. + +Report it privately through +[Security → Report a vulnerability](https://github.com/erigontech/erigon/security/advisories/new). +That route reaches the maintainers directly and gives us a private space to prepare a fix with you. +It needs only a GitHub account, and nothing becomes public until we publish an advisory together. + +Please include what an attacker can achieve with the issue, the Erigon version you're running, the +chain and any flags relevant to it, steps to reproduce, and any disclosure deadline you're working +to. + +We aim to acknowledge a report within three business days and will keep you posted while we work on +it. We'll credit you in the advisory unless you'd rather stay anonymous, and we ask that you give us +a reasonable window to ship a fix before disclosing publicly. Erigon doesn't run a bug bounty +programme, so reports aren't paid. + +## Supported versions + +Security fixes land on `main` and in the most recent release series; earlier series aren't patched, +so the fix arrives by upgrading. See [Releases](https://github.com/erigontech/erigon/releases) for +the current series. + +For anything that isn't a security issue, open a normal +[issue](https://github.com/erigontech/erigon/issues) instead.