diff --git a/SECURITY.md b/SECURITY.md index 3d9596c1..7164dde5 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,10 +2,25 @@ ## Reporting a Vulnerability -EVE community takes security seriously. If you discover a security issue, please bring it to our attention right away! +The EVE community takes security seriously. If you discover a security +issue, please bring it to our attention right away. -Please DO NOT file a public issue, instead send your report privately to eve-security@lists.lfedge.org. +Please DO NOT file a public issue. Report it privately instead, either by +email to [eve-security@lists.lfedge.org][mail] or through GitHub's +[private vulnerability reporting][gh-report] on the EVE repository. -## Security Overview +## Project-Wide Security Policy -The main EVE repo's [CONTRIBUTING.md](https://github.com/lf-edge/eve/blob/master/CONTRIBUTING.md) and [SECURITY.md](https://github.com/lf-edge/eve/blob/master/docs/SECURITY.md) has additional information about contributions and security approaches. +This repository is part of the EVE project and is covered by the +project-wide security policy maintained in the main EVE repository: + +- [SECURITY.md][policy] for supported versions, what to include in a + report, response timeline, and the coordinated disclosure process. +- [SECURITY-ARCHITECTURE.md][arch] for the EVE security model. +- [CONTRIBUTING.md][contrib] for contribution guidelines. + +[mail]: mailto:eve-security@lists.lfedge.org +[gh-report]: https://github.com/lf-edge/eve/security/advisories/new +[policy]: https://github.com/lf-edge/eve/blob/master/SECURITY.md +[arch]: https://github.com/lf-edge/eve/blob/master/docs/SECURITY-ARCHITECTURE.md +[contrib]: https://github.com/lf-edge/eve/blob/master/CONTRIBUTING.md