From 62b2bff1315e7046f729989776813c79166de886 Mon Sep 17 00:00:00 2001 From: Antony Pegg Date: Thu, 20 Aug 2026 10:47:56 -0400 Subject: [PATCH 1/2] docs: add SECURITY.md Points at security@pgedge.com as the single reporting route and at the pgEdge Vulnerability Disclosure Statement for scope, safe harbour and CVE handling. Identical across every pgEdge product repository. Do not merge before pgEdge/pgedge-docs#138 publishes docs.pgedge.com/security; until it does, the only link in this file 404s. --- SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3ba2905 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy + +## Reporting a Vulnerability + +Please report security vulnerabilities to **security@pgedge.com**, which +reaches the pgEdge security team. + +Please do not open a public issue for a suspected vulnerability. + +Tell us the product and version, what the impact is, and how to reproduce +it. You do not need to sign anything or hold a pgEdge contract to report to +us. + +We acknowledge reports within five business days, tell you the outcome of +our assessment, and tell you before we publish anything. + +## Supported Versions + +Security fixes are provided for the latest release of each product. Where a +product has its own published support lifecycle, that lifecycle governs. + +## Scope and Safe Harbour + +What is in scope, our safe harbour terms, and how we handle coordinated +disclosure and CVE identifiers are all set out in the pgEdge Vulnerability +Disclosure Statement: + +**https://docs.pgedge.com/security** + +You may test this software freely in an environment you control. Testing +pgEdge Cloud requires prior written authorisation — see the statement. + +## Published Advisories + +Advisories are published under the Security tab of the repository for the +affected product. From 2b4594dae169c41a327ef05e06855e7ed19395b2 Mon Sep 17 00:00:00 2001 From: Antony Pegg Date: Thu, 20 Aug 2026 10:49:08 -0400 Subject: [PATCH 2/2] docs: remove the superseded .github/SECURITY.md It pointed reporters at security/advisories/new, GitHub's private vulnerability reporting form. That is disabled org-wide and stays disabled, so the link is dead and the file offered no email fallback. It also promised a fix timeline, which is not something we have approved. A file in .github/ takes precedence over one in the root, so the new root SECURITY.md does not supersede it on its own. --- .github/SECURITY.md | 23 ----------------------- 1 file changed, 23 deletions(-) delete mode 100644 .github/SECURITY.md diff --git a/.github/SECURITY.md b/.github/SECURITY.md deleted file mode 100644 index b2d1477..0000000 --- a/.github/SECURITY.md +++ /dev/null @@ -1,23 +0,0 @@ -# Security Policy - -## Supported versions - -ColdFront is under active development; security fixes are applied to the `main` -branch and released from there. - -## Reporting a vulnerability - -**Please do not open a public issue for security vulnerabilities.** - -Report privately through GitHub's **Security Advisories** — use -**[Report a vulnerability](https://github.com/pgEdge/ColdFront/security/advisories/new)** -on the repository's *Security* tab. Please include: - -- a description of the vulnerability and its impact, -- steps to reproduce or a proof of concept, -- the affected version / commit, -- any suggested remediation. - -We will acknowledge the report, investigate, and keep you updated on progress and -the fix timeline. Please allow a reasonable disclosure window before any public -discussion.