Add Security Policy

CHANGES.rst

@@ -16,7 +16,7 @@ Breaking changes:
 
 New features:
 
-- ...
+- Add :ref:`Security Policy`
 
 Bug fixes:
 

CONTRIBUTING.rst

@@ -18,12 +18,12 @@ For pull requests, keep this in mind
 
 - Add a test which proves your fix and make it pass.
 
-- Describe your change in CHANGES.rst
+- Describe your change in ``CHANGES.rst``
 
-- Add yourself to the docs/credits.rst
+- Add yourself to the ``docs/credits.rst``
 
-Development Setup
------------------
+Setup for Development
+---------------------
 
 If you would like to setup icalendar to
 contribute changes, the `Installation Section

SECURITY.md

@@ -0,0 +1,7 @@
+# Security Policy
+
+Please find our [security policy in the documentation](https://icalendar.readthedocs.io/en/latest/security.html).
+
+See also:
+
+- [docs/security.rst](docs/security.rst)

docs/conf.py

@@ -21,7 +21,9 @@
     'sphinx.ext.autodoc',
     'sphinx.ext.coverage',
     'sphinx.ext.viewcode',
-    'sphinx_copybutton'
+    'sphinx_copybutton',
+    'sphinx.ext.intersphinx',
+    'sphinx.ext.autosectionlabel',
 ]
 source_suffix = '.rst'
 master_doc = 'index'

docs/contributing.rst

@@ -1,5 +1,3 @@
-.. _contributing:
-
 ------------------
 Contributing
 ------------------

docs/index.rst

@@ -21,3 +21,4 @@ Contents
     :titlesonly:
 
     contributing
+    security

docs/security.rst

@@ -0,0 +1,58 @@
+Security Policy
+===============
+
+This documents the security policy and actions to take to secure the package and its deployment and use.
+
+Supported Versions
+------------------
+
+Security vulnerabilities are fixed only for the latest version of ``icalendar``.
+
+.. list-table:: Versions to receive security updates
+   :widths: 25 25
+   :header-rows: 1
+
+   * - Version
+     - Supported
+   * - 6.*
+     - YES
+   * - 5.*
+     - no
+   * - 4.*
+     - no
+   * - before 4.*
+     - no
+
+
+Reporting a Vulnerability
+-------------------------
+
+To report security issues of ``collective/icalendar``, use the ``Report a vulnerability`` button on the project's `Security Page <https://github.com/collective/icalendar/security>`_.
+If you cannot do this, please contact one of the :ref:`maintainers` directly.
+
+The maintainers of ``icalendar`` will then notify `Plone's security team <https://plone.org/security/report>`_.
+
+If we determine that your report may be a security issue with the project, we may contact you for further information.
+We volunteers ask that you delay public disclosure of your report for at least ninety (90) days from the date you report it to us.
+This will allow sufficient time for us to process your report and coordinate disclosure with you.
+
+Once verified and fixed, the following steps will be taken:
+
+-   We will use GitHub's Security Advisory tool to report the issue.
+-   GitHub will review our Security Advisory report for compliance with Common Vulnerabilities and Exposures (CVE) rules.
+    If it is compliant, they will submit it to the MITRE Corporation to generate a `CVE <https://www.cve.org/>`_.
+    This in turn submits the CVE to the `National Vulnerability Database (NVD) <https://nvd.nist.gov/vuln/search>`_.
+    GitHub notifies us of their decision.
+-   Assuming it is compliant, we then publish our Security Advisory on GitHub, which triggers the next steps.
+-   GitHub will publish the CVE to the CVE List.
+-   GitHub will broadcast our Security Advisory via the `GitHub Advisory Database <https://github.com/advisories>`_.
+-   GitHub will send `security alerts <https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies>`_ to all repositories that use our package (and have opted into security alerts).
+    This includes Dependabot alerts.
+-   We will make a bug-fix release.
+-   We will send an announcement through our usual channels:
+
+    - The :ref:`Changelog`
+    - The GitHub releases of ``icalendar``
+    - If possible also `Plone's Security Announcements <https://plone.org/security/announcements>`_
+
+-   We will provide credit to the reporter or researcher in the vulnerability notice.