Create SECURITY.md #148
Create SECURITY.md #148
Conversation
WalkthroughA new SECURITY.md file has been added, establishing the security policy for the KubeElasti project. The document details supported versions, in-scope components, reporting procedures, disclosure policy, and recognition for security reporters, while clarifying exclusions and the absence of a monetary bounty. Changes
Estimated code review effort1 (<30 minutes) Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🧰 Additional context used🪛 LanguageToolSECURITY.md[style] ~54-~54: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym. (ENGLISH_WORD_REPEAT_BEGINNING_RULE) 🪛 markdownlint-cli2 (0.17.2)SECURITY.md14-14: Trailing spaces (MD009, no-trailing-spaces) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
SECURITY.md(1 hunks)
🧰 Additional context used
🪛 LanguageTool
SECURITY.md
[grammar] ~1-~1: Use correct spacing
Context: # Security Policy KubeElasti values the contributions of i...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~3-~3: Use correct spacing
Context: ...intainers committed to safeguarding the project. --- ## 🛡️ Supported Versions | Version | Supp...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~7-~7: Use correct spacing
Context: ...ing the project. --- ## 🛡️ Supported Versions | Version | Supported | Notes ...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~12-~12: Use correct spacing
Context: ... ❌ | End‑of‑life | > We generally provide security fixes for ...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~14-~14: Use correct spacing
Context: ...rity fixes for the latest minor release lines. --- ## 🔐 Scope The following components are *...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~18-~18: Use correct spacing
Context: ...atest minor release lines. --- ## 🔐 Scope The following components are *in‑scope...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~24-~24: There might be a mistake here.
Context: ...s manifests distributed in the official repository * All container images published under `gh...
(QB_NEW_EN_OTHER)
[grammar] ~25-~25: Use correct spacing
Context: ...sitory * All container images published under ghcr.io/truefoundry/elasti* Out‑of‑scope issues include but are not ...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~35-~35: Use correct spacing
Context: ...security impact --- ## 📬 Reporting a Vulnerability 1. Email a detailed report to our private...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~38-~38: Use correct spacing
Context: ...(mailto:[email protected])**. 2. Include: * A descriptive title (e.g., *"Denial‑of‑S...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~46-~46: Use correct spacing
Context: ...open a public GitHub issue for security problems. --- ## 🔄 Disclosure Policy * We follow **coor...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~50-~50: Use correct spacing
Context: ...curity problems. --- ## 🔄 Disclosure Policy * We follow coordinated disclosure. * ...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[style] ~54-~54: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ease notes once a patch is available. * We credit reporters **unless anonymity is ...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[grammar] ~57-~57: Use correct spacing
Context: ...re happy to provide swag and public recognition. --- ## 🙏 Thank You Your efforts make the Kube...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~61-~61: Use correct spacing
Context: ...d public recognition. --- ## 🙏 Thank You Your efforts make the KubeElasti ecosyst...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
🪛 markdownlint-cli2 (0.17.2)
SECURITY.md
14-14: Trailing spaces
Expected: 0 or 2; Actual: 1
(MD009, no-trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: test (/home/runner/work/KubeElasti/KubeElasti/pkg)
- GitHub Check: golangci-lint (/home/runner/work/KubeElasti/KubeElasti/operator)
- GitHub Check: test (/home/runner/work/KubeElasti/KubeElasti/resolver)
- GitHub Check: test (/home/runner/work/KubeElasti/KubeElasti/operator)
- GitHub Check: Run Kuttl E2E Tests
SECURITY.md
Outdated
| 1. **Email** a detailed report to our private list: **[[email protected]](mailto:[email protected])**. | ||
| 2. Include: | ||
|
|
||
| * A descriptive title (e.g., *"Denial‑of‑Service via oversized HTTP header"*). | ||
| * Affected versions and environment details. | ||
| * Reproduction steps or proof‑of‑concept (PoC) code. | ||
| * Expected vs. actual behavior. | ||
| * Impact assessment (confidentiality, integrity, availability). | ||
| * *Optional* patch or mitigation ideas. | ||
| 3. *Do NOT* open a public GitHub issue for security problems. |
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Offer an encrypted channel for sensitive reports
Industry norm is to publish a PGP key or at least accept encrypted mail (per CVE.org guidelines). Attackers may intercept unencrypted disclosures. Add a “PGP key” subsection with fingerprint & download link.
🧰 Tools
🪛 LanguageTool
[grammar] ~38-~38: Use correct spacing
Context: ...(mailto:[email protected])**. 2. Include: * A descriptive title (e.g., *"Denial‑of‑S...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~46-~46: Use correct spacing
Context: ...open a public GitHub issue for security problems. --- ## 🔄 Disclosure Policy * We follow **coor...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
🤖 Prompt for AI Agents
In SECURITY.md around lines 37 to 46, the security reporting instructions
currently only mention sending unencrypted email. To improve security, add a new
subsection titled "PGP key" that provides a PGP key fingerprint and a download
link for the public key. This will enable reporters to send encrypted
vulnerability reports, protecting sensitive information from interception.
Add a security policy to report vulnerabilities.
Summary by CodeRabbit