|
1 | | -# Hyperledger Security Policy |
| 1 | +[//]: # (SPDX-License-Identifier: CC-BY-4.0) |
2 | 2 |
|
3 | | -## Reporting a Security Bug |
| 3 | +# Panurus, an LF Decentralized Trust Project Security Policy |
4 | 4 |
|
5 | | -If you think you have discovered a security issue in any of the Hyperledger projects, we'd love to hear from you. We will take all security bugs seriously and if confirmed upon investigation we will patch it within a reasonable amount of time and release a public security bulletin discussing the impact and credit the discoverer. |
| 5 | +## About this document |
6 | 6 |
|
7 | | -The easiest is to email a description of the flaw and any related information (e.g. reproduction steps, version) to [security at hyperledger dot org](mailto:security@hyperledger.org). |
| 7 | +This is the vulnerability disclosure policy for the Panurus project. It conforms to the |
| 8 | +[LF Decentralized Trust Security Vulnerability Disclosure Policy][lfdt-security] and is adapted |
| 9 | +from the LFDT `SAMPLE-SECURITY.md` template. Where this document is silent, the LFDT policy governs. |
8 | 10 |
|
9 | | -The process by which the Hyperledger Security Team handles security bugs is documented further in our [Defect Response page](https://wiki.hyperledger.org/display/SEC/Defect+Response) on our [wiki](https://wiki.hyperledger.org). |
| 11 | +## Security Team |
| 12 | + |
| 13 | +The Panurus security team is responsible for receiving, triaging, and coordinating the response to |
| 14 | +vulnerability reports. Each member subscribes to the LF Decentralized Trust security email list and |
| 15 | +to LFDT-wide security infrastructure. Members are added to and removed from the team via approved |
| 16 | +pull requests against this file. |
| 17 | + |
| 18 | +| Name | Email ID | Discord ID | Area/Specialty | |
| 19 | +|------|----------|------------|----------------| |
| 20 | +| Angelo De Caro | <adc@zurich.ibm.com> | adecaro | Cryptography, zero-knowledge token protocols (`zkatdlog`) | |
| 21 | +| Kaoutar Elkhiyaoui | <kao@zurich.ibm.com> | KElkhiyaoui | Cryptography, token protocol design and validation | |
| 22 | +| Akram Bitar | <akram@il.ibm.com> | akrambitar | SDK, drivers, integration and CI | |
| 23 | + |
| 24 | +Because Panurus contains security-sensitive cryptographic code — zero-knowledge proofs, range |
| 25 | +proofs, and Idemix-based identity under `token/core/zkatdlog/` — the security team includes |
| 26 | +maintainers with cryptography expertise, per the LFDT policy. |
| 27 | + |
| 28 | +The security team accepts the following responsibilities: |
| 29 | + |
| 30 | +1. Acknowledge receipt of a report to the reporter within **2 business days**. |
| 31 | +2. Triage the report, and open a GitHub Security Advisory if it appears to be a vulnerability. |
| 32 | + Reports that are ordinary bugs are redirected to the normal issue process, and the reporter is told so. |
| 33 | +3. Negotiate an embargo period with the reporter where needed. An embargo **must not exceed 90 days**. |
| 34 | +4. Develop and review the patch privately, using GitHub's private vulnerability patching features. |
| 35 | +5. Obtain a CVE identifier. |
| 36 | +6. Agree on a disclosure date and notify embargo list members, if applicable. |
| 37 | +7. Ship a release containing the fix. |
| 38 | +8. Disclose publicly **within 48 hours after the release**, via a GitHub Security Advisory. |
| 39 | +9. Credit the reporter in the advisory, unless they ask to remain anonymous. |
| 40 | + |
| 41 | +## Discussion Forums |
| 42 | + |
| 43 | +Vulnerability discussion happens in the private GitHub Security Advisory opened for the report. |
| 44 | +A private channel on the [LF Decentralized Trust Discord][discord] may be created if broader |
| 45 | +coordination is required. |
| 46 | + |
| 47 | +**Do not** discuss a suspected vulnerability in a public issue, pull request, discussion, or |
| 48 | +Discord channel before it has been disclosed. |
| 49 | + |
| 50 | +## Report Intakes |
| 51 | + |
| 52 | +Report a suspected vulnerability through **either** of these channels: |
| 53 | + |
| 54 | +- **Email** the LF Decentralized Trust security email list at |
| 55 | + <security@lists.lfdecentralizedtrust.org>. Please include: |
| 56 | + - the repository name (`LFDT-Panurus/panurus`), |
| 57 | + - a description of the issue, |
| 58 | + - steps to reproduce, |
| 59 | + - affected versions, |
| 60 | + - any known mitigations. |
| 61 | +- **GitHub private vulnerability reporting** — open a draft advisory from the |
| 62 | + [Security tab][security-tab] of the repository. |
| 63 | + |
| 64 | +Reports are handled per the response outline above. |
| 65 | + |
| 66 | +## CNA/CVE Reporting |
| 67 | + |
| 68 | +GitHub acts as the CVE Numbering Authority (CNA) for Panurus. The security team requests CVE |
| 69 | +identifiers through the GitHub Security Advisory workflow. |
| 70 | + |
| 71 | +## Embargo List |
| 72 | + |
| 73 | +Panurus does not maintain a project-specific embargo list. Where an embargo is warranted, the |
| 74 | +security team coordinates through the LFDT security email list and the private GitHub advisory. |
| 75 | +Requests to be included in a specific embargo should be sent to |
| 76 | +<security@lists.lfdecentralizedtrust.org> with the project name and the rationale for a |
| 77 | +need-to-know. |
| 78 | + |
| 79 | +## Security Advisories |
| 80 | + |
| 81 | +Panurus uses [GitHub Security Advisories][advisories] as its advisory mechanism. Published |
| 82 | +advisories are the authoritative record of disclosed vulnerabilities for the project. |
| 83 | + |
| 84 | +## Private Patch Deployment Infrastructure |
| 85 | + |
| 86 | +Panurus uses GitHub's private vulnerability patching features, which allow the fix to be developed |
| 87 | +and reviewed in a private fork associated with the advisory. Maintainers needing access or |
| 88 | +assistance can contact <community-architects@lfdecentralizedtrust.org>. |
| 89 | + |
| 90 | +--- |
| 91 | + |
| 92 | +This policy borrows heavily from the recommendations of the OpenSSF Vulnerability Disclosure |
| 93 | +working group ([ossf/wg-vulnerability-disclosures][ossf-wg]), and the response outline derives from |
| 94 | +the OpenSSF maintainers guide. |
| 95 | + |
| 96 | +<a rel="license" href="http://creativecommons.org/licenses/by/4.0/"><img alt="Creative Commons License" style="border-width:0" src="https://i.creativecommons.org/l/by/4.0/88x31.png" /></a><br />This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution 4.0 International License</a>. |
| 97 | + |
| 98 | +[lfdt-security]: https://github.com/LF-Decentralized-Trust/governance/blob/main/tac/governing-documents/security.md |
| 99 | +[discord]: https://discord.gg/hyperledger |
| 100 | +[security-tab]: https://github.com/LFDT-Panurus/panurus/security |
| 101 | +[advisories]: https://github.com/LFDT-Panurus/panurus/security/advisories |
| 102 | +[ossf-wg]: https://github.com/ossf/wg-vulnerability-disclosures |
0 commit comments