diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5ac7f77 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,35 @@ +# Security Policy + +## Supported Versions + +Use this section to tell people about which versions of your project are currently being supported with security updates. + +| Version | Supported | +| ---------------------- | ------------------ | +| Pre-Release (Alpha) | :white_check_mark: | + +## Reporting a Vulnerability + +Use this section to tell people how to report a vulnerability. + +If you discover a vulnerability in lvm2go, please report it as soon as possible to help us keep the project secure. Here's how you can report a vulnerability: + +1. **Email:** Send an email to [contact@jakob-moeller.com](mailto:contact@jakob-moeller.com) with the subject line "Vulnerability Report: [Title of Vulnerability]". +2. **Details:** In your email, include the following details: + - A detailed description of the vulnerability + - Steps to reproduce the vulnerability + - Any relevant logs, screenshots, or proof of concept code + - Potential impact of the vulnerability + +### Response Time + +- **Acknowledgment:** You will receive an acknowledgment of your report within 5 business days. +- **Updates:** We will provide updates on the status of your reported vulnerability at least once every 14 days. +- **Resolution:** You can expect a resolution or detailed response, including possible mitigation steps, within 30 days. + +### What to Expect + +- **Acceptance:** If the vulnerability is accepted, we will work on a fix and release a security update. You will be credited for your discovery unless you wish to remain anonymous. +- **Decline:** If the vulnerability is not accepted, we will provide a detailed explanation of why it was not considered a security issue. + +Thank you for helping us keep lvm2go secure!