From 1f8353627e906d56f527ee9b6657b22b981331fc Mon Sep 17 00:00:00 2001 From: Nate Marsella Date: Wed, 26 Aug 2026 10:03:04 -0400 Subject: [PATCH] Add SECURITY.md for CRA Signed-off-by: Nate Marsella --- SECURITY.md | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5939698 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,41 @@ +# Reporting a Security Vulnerability or Incident for IIB + +Please do not report security vulnerabilities or security incidents via public channels (such as GitHub Issues or Pull Requests). + +To ensure coordinated disclosure, please email the IIB security team at _exd-guild-hello-operator-admins\[at\]redhat.com_ with a description of the issue, how to reproduce it and any mitigations you are aware of. + +If possible please include a proposed severity rating (for example, see [Red Hat's severity ratings](https://access.redhat.com/security/updates/classification)), and other classifying metadata such as a [CWE](https://cwe.mitre.org/) ID or a [CVSS](https://www.first.org/cvss/) score. + +## Response Timeline + +Our security team will respond within three working days of your email. + +## Submission Guidelines + +To help us triage and resolve the issue efficiently, please include the following in your report: + +- **Title**: A concise, descriptive summary of the issue. +- **Reporter Details**: Your name/handle and affiliation. +- **Technical Description**: Detailed information regarding the vulnerability. +- **Affected Versions**: The specific version(s) or range(s) of software tested. +- **Reproduction Steps**: A minimal, functional example to reproduce the issue. +- **Impact Assessment**: Potential exploit scenarios and perceived severity. (optional) +- **Suggested Fix**: Any proposed patches or mitigations (optional). +- **Disclosure Status**: Whether this has been shared with other parties or published and your plan for future sharing (e.g., at a conference). + +## Contact Information + +Direct all security questions and vulnerability reports to: + +- **Email**: _exd-guild-hello-operator-admins\[at\]redhat.com_ + +## Security Policy + +Full details of Red Hat’s security disclosure and remediation process can be found here: + +## EU Cyber Resilience Act — Open Source Steward Statement + +This project is stewarded by **Red Hat, Inc.**, an open source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng). +Contact: [cra-steward@redhat.com](mailto:cra-steward@redhat.com) + +Refer to [Red Hat's security practices and vulnerability management policy](https://access.redhat.com/security/) for detailed information.