|
1 | 1 | # Security Policy |
2 | | -Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, |
3 | | -impact, severity and mitigation. |
| 2 | +As an open-source project, we understand the importance of and responsibility |
| 3 | +for security. This Security Policy outlines our guidelines and procedures to |
| 4 | +ensure the highest level of security and trust for oneTBB users. |
4 | 5 |
|
5 | | -## Reporting a Vulnerability |
6 | | -Please report any security vulnerabilities in this project |
7 | | -[utilizing the guidelines here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html). |
| 6 | +## Supported Versions |
| 7 | +Security vulnerabilities are fixed in the [latest version][1] |
| 8 | +and delivered as a patch release. We don't guarantee security fixes to be |
| 9 | +back-ported to older oneTBB versions. |
| 10 | + |
| 11 | +## Report a Vulnerability |
| 12 | +We are very grateful to the security researchers and users that report back |
| 13 | +security vulnerabilities. We investigate every report thoroughly. |
| 14 | +We strongly encourage you to report security vulnerabilities to us privately, |
| 15 | +before disclosing them on public forums or opening a public GitHub* issue. |
| 16 | + |
| 17 | +Report a vulnerability to us in one of two ways: |
| 18 | +* Open a draft **[GitHub* Security Advisory][2]** |
| 19 | +* Send an e-mail to: **[email protected]**. |
| 20 | +Along with the report, provide the following info: |
| 21 | + * A descriptive title. |
| 22 | + * Your name and affiliation (if any). |
| 23 | + * A description of the technical details of the vulnerabilities. |
| 24 | + * A minimal example of the vulnerability so we can reproduce your findings. |
| 25 | + * An explanation of who can exploit this vulnerability, and what they gain |
| 26 | + doing so. |
| 27 | + * Whether this vulnerability is public or known to third parties. If it is, |
| 28 | + provide details. |
| 29 | + |
| 30 | +### When Should I Report a Vulnerability? |
| 31 | +* You think you discovered a potential security vulnerability in oneTBB. |
| 32 | +* You are unsure how the potential vulnerability affects oneTBB. |
| 33 | +* You think you discovered a vulnerability in another project or 3rd party |
| 34 | +component on which oneTBB depends. If the issue is not fixed in the 3rd party |
| 35 | +component, try to report directly there first. |
| 36 | + |
| 37 | +### When Should I NOT Report a Vulnerability? |
| 38 | +* You got an automated scan hit and are unable to provide details. |
| 39 | +* You need help using oneTBB for security. |
| 40 | +* You need help applying security-related updates. |
| 41 | +* Your issue is not security-related. |
| 42 | + |
| 43 | +## Security Reports Review Process |
| 44 | +We aim to respond quickly to your inquiry and coordinate a fix and |
| 45 | +disclosure with you. All confirmed security vulnerabilities will be addressed |
| 46 | +according to severity level and impact on oneTBB. Normally, security issues |
| 47 | +are fixed in the next planned release. |
| 48 | + |
| 49 | +## Disclosure Policy |
| 50 | +We will publish security advisories using the |
| 51 | +[**GitHub Security Advisories feature**][3] |
| 52 | +to keep our community well-informed, and will credit you for your findings |
| 53 | +unless you prefer to stay anonymous. We request that you refrain from |
| 54 | +exploiting the vulnerability or making it public before the official disclosure. |
| 55 | + |
| 56 | +We will disclose the vulnerabilities and bugs as soon as possible once |
| 57 | +mitigation is implemented and available. |
| 58 | + |
| 59 | +## Feedback on This Policy |
| 60 | +If you have any suggestions on how this Policy could be improved, submit |
| 61 | +an issue or a pull request to this repository. **Do not** report |
| 62 | +potential vulnerabilities or security flaws via a pull request. |
| 63 | + |
| 64 | +[1]: https://github.com/oneapi-src/oneTBB/releases/latest |
| 65 | +[2]: https://github.com/oneapi-src/oneTBB/security/advisories/new |
| 66 | +[3]: https://github.com/oneapi-src/oneTBB/security/advisories |
0 commit comments