First pass at defining our threat model and security policy #1630
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
SECURITY.md
Outdated
| * Package definitions, both for building packages and resulting from a build are Python files (`package.py`). Rez will read and load them in memory at resolve time. | ||
| * Rez config files can be written in YAML or Python. | ||
| * Package definitions and config files written in Python can contain arbitrary code. | ||
| * Rez will create new shells via subprocesses. |
There was a problem hiding this comment.
Should we state that shells can be nested? I feel like we should since that's differentiator from other environment managers (conda, virtualenv, etc).
| If you think you've found a potential vulnerability in rez, please report it by filing a GitHub [security | ||
| advisory](https://github.com/AcademySoftwareFoundation/rez/security/advisories/new). Alternatively, email [email protected] and provide your contact info for further private/secure discussion. If your email does not receive a prompt acknowledgement, your address may be blocked. | ||
|
|
||
| Our policy is to acknowledge the receipt of vulnerability reports within 72 hours. |
There was a problem hiding this comment.
I think 72 hours is reasonable for a first response. Any opinions?
Signed-off-by: Jean-Christophe Morin <[email protected]>
JeanChristopheMorinPerso
force-pushed
the
threat_model_and_security_policy
branch
from
c6ad49b to
99839c9
Compare
Signed-off-by: Jean-Christophe Morin <[email protected]>
JeanChristopheMorinPerso
force-pushed
the
threat_model_and_security_policy
branch
from
28a8287 to
1f02338
Compare
Signed-off-by: Jean-Christophe Morin <[email protected]>
Signed-off-by: Jean-Christophe Morin <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #1650
Very WIP. Created a draft PR for visibility.