From d66761b017f3a22c76cc09ba207543d1b7bbc98b Mon Sep 17 00:00:00 2001 From: Jochen Staerk Date: Wed, 5 Mar 2025 11:23:50 +0100 Subject: [PATCH] Create SECURITY.md upon request :-) --- SECURITY.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..38dd608d --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,29 @@ +# Security Policy + +## Supported Versions + +The following versions are currently being supported with security updates. + +| Version | Supported | +| ------- | ------------------ | +| 2.x.x | :white_check_mark: | +| < 2.0 | :x: | + +## Reporting a Vulnerability + +Feel free to submit issues to info at mustangproject.org with [security] indicated in the subject. +We may ask back questions but we usually open (or communicate about) an issue (potentially in a private location you would be provided with access to) and decide on the severity within two working days. + +Please indicate +* a proof of concept, if possible +* If any of the information you submit, e.g. an invoice which can not be [anonymized](https://github.com/ZUGFeRD/einvoice-anonymizer), is confidential +* A quick justification why you require a fix in a older version than he most up to date one, if you can not update to the most recent version +* If you require encrypted communication (our GPG fingerprint will likely be 68F4 2269 8165 F0F5 63CA A13B 7CB7 1548 B596 66A3) + + +## After your Report + +We try to fix critical issues in less than a week, and release a fixed version in less than two weeks. + +Thank you for keeping our software safe! +