Skip to content

Commit c607e21

Browse files
ljharbljharb
committed
[meta] update security policy; add IRP
1 parent 977563e commit c607e21

File tree

2 files changed

+137
-7
lines changed

2 files changed

+137
-7
lines changed

‎.github/INCIDENT_RESPONSE_PLAN.md‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# Incident Response Process for **nvm**
2+
3+
## Supported Versions
4+
5+
Latest version: v0.40.3
6+
7+
| Version | Supported | End of Support |
8+
| -------- | ------------------ | -------------- |
9+
| 0.40.x | :white_check_mark: | TBD |
10+
| 0.39.x | :white_check_mark: | 2025-12-31 |
11+
| < 0.39.x | :x: | Ended |
12+
13+
**Note**: We support the current minor series and one previous series. Users are strongly encouraged to upgrade to the latest version for the best security posture.
14+
15+
## Reporting a Vulnerability
16+
17+
We take the security of **nvm** very seriously. If you believe you’ve found a security vulnerability, please inform us responsibly through coordinated disclosure.
18+
19+
### How to Report
20+
21+
> **Do not** report security vulnerabilities through public GitHub issues, discussions, or social media.
22+
23+
Instead, please use one of these secure channels:
24+
25+
1. **GitHub Security Advisories**
26+
Use the **Report a vulnerability** button in the Security tab of the [nvm-sh/nvm repository](https://github.com/nvm-sh/nvm).
27+
28+
2. **Email**
29+
Follow the posted [Security Policy](https://github.com/nvm-sh/nvm/security/policy).
30+
31+
### What to Include
32+
33+
**Required Information:**
34+
- Brief description of the vulnerability type
35+
- Affected version(s) and components
36+
- Steps to reproduce the issue
37+
- Impact assessment (what an attacker could achieve)
38+
39+
**Helpful Additional Details:**
40+
- Full paths of affected scripts or files
41+
- Specific commit or branch where the issue exists
42+
- Required configuration to reproduce
43+
- Proof-of-concept code (if available)
44+
- Suggested mitigation or fix
45+
46+
## Our Response Process
47+
48+
**Timeline Commitments:**
49+
- **Initial acknowledgment**: Within 24 hours
50+
- **Detailed response**: Within 3 business days
51+
- **Status updates**: Every 7 days until resolved
52+
- **Resolution target**: 90 days for most issues
53+
54+
**What We’ll Do:**
55+
1. Acknowledge your report and assign a tracking ID
56+
2. Assess the vulnerability and determine severity
57+
3. Develop and test a fix
58+
4. Coordinate disclosure timeline with you
59+
5. Release a security update and publish an advisory and CVE
60+
6. Credit you in our security advisory (if desired)
61+
62+
## Disclosure Policy
63+
64+
- **Coordinated disclosure**: We’ll work with you on timing
65+
- **Typical timeline**: 90 days from report to public disclosure
66+
- **Early disclosure**: If actively exploited
67+
- **Delayed disclosure**: For complex issues
68+
69+
## Scope
70+
71+
**In Scope:**
72+
- **nvm** project (all supported versions)
73+
- Installation and update scripts (`install.sh`, `nvm.sh`)
74+
- Official documentation and CI/CD integrations
75+
- Dependencies with direct security implications
76+
77+
**Out of Scope:**
78+
- Third-party forks or mirrors
79+
- Platform-specific installs outside core scripts
80+
- Social engineering or physical attacks
81+
- Theoretical vulnerabilities without practical exploitation
82+
83+
## Security Measures
84+
85+
**Our Commitments:**
86+
- Regular vulnerability scanning via GitHub Actions
87+
- Automated security checks in CI/CD pipelines
88+
- Secure scripting practices and mandatory code review
89+
- Prompt patch releases for critical issues
90+
91+
**User Responsibilities:**
92+
- Keep **nvm** updated
93+
- Verify script downloads via PGP signatures
94+
- Follow secure configuration guidelines for shell environments
95+
96+
## Legal Safe Harbor
97+
98+
**We will NOT:**
99+
- Initiate legal action
100+
- Contact law enforcement
101+
- Suspend or terminate your access
102+
103+
**You must:**
104+
- Only test against your own installations
105+
- Not access, modify, or delete user data
106+
- Not degrade service availability
107+
- Not publicly disclose before coordinated disclosure
108+
- Act in good faith
109+
110+
## Recognition
111+
112+
- **Advisory Credits**: Credit in GitHub Security Advisories (unless anonymous)
113+
114+
## Security Updates
115+
116+
**Stay Informed:**
117+
- Subscribe to GitHub releases for **nvm**
118+
- Enable GitHub Security Advisory notifications
119+
120+
**Update Process:**
121+
- Patch releases (e.g., v0.40.3 → v0.40.4)
122+
- Out-of-band releases for critical issues
123+
- Advisories via GitHub Security Advisories
124+
125+
## Contact Information
126+
127+
- **Security reports**: Security tab of [nvm-sh/nvm](https://github.com/nvm-sh/nvm/security)
128+
- **General inquiries**: GitHub Discussions or Issues
129+

‎.github/SECURITY.md‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Security
22

3-
Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report.
3+
Please file a private vulnerability report via GitHub, email [@ljharb](https://github.com/ljharb), or see https://tidelift.com/security if you have a potential security vulnerability to report.
44

55
## OpenSSF CII Best Practices
66

@@ -12,16 +12,17 @@ There are three “tiers”: passing, silver, and gold.
1212
We meet 100% of the “passing” criteria.
1313

1414
### Silver
15-
We meet 95% of the “silver” criteria. The gaps are as follows:
16-
- we do not have a DCO or a CLA process for contributions.
17-
- because we only have one maintainer, the project has no way to continue if that maintainer stops being active.
18-
- we do not currently document “what the user can and cannot expect in terms of security” for our project. This is planned to be completed in 2023.
15+
We meet 100% of the “silver” criteria.
1916

2017
### Gold
21-
We meet 65% of the “gold” criteria. The gaps are as follows:
22-
- we do not yet have the “silver” badge; see all the gaps above.
18+
We meet 78% of the “gold” criteria. The gaps are as follows:
19+
- because we only have one maintainer, the project has no way to continue if that maintainer stops being active.
2320
- We do not include a copyright or license statement in each source file. Efforts are underway to change this archaic practice into a suggestion instead of a hard requirement.
2421

2522
## Threat Model
2623

2724
See [THREAT_MODEL.md](./THREAT_MODEL.md).
25+
26+
## Incident Response Plan
27+
28+
Please see our [Incident Response Plan](./INCIDENT_RESPONSE_PLAN.md).

0 commit comments

Comments
 (0)