search

boostorg / boost

Super-project for modularized Boost
https://github.com/boostorg/wiki/wiki/Getting-Started%3A-Overview
Boost Software License 1.0
7.02k stars 1.73k forks source link

Add Security Policy #805

Open gabibguti opened 12 months ago

gabibguti commented 12 months ago

Adding a Security Policy is important to provide guidance on how users can report potential vulnerabilities and communicate when vulnerabilities will be confirmed, fixed and disclosed to the public. When possible, vulnerabilities should be reported privately to avoid being exploited by attackers. It could have been useful in this case https://github.com/boostorg/boost/issues/747 for example.

This is considered a good-practice and recommended by Github and Scorecard.

If you agree with this addition, I can support you by opening a PR with a Security Policy draft.

Additional Context

Hi! I'm Gabriela and I work on behalf of Google and the OpenSSF suggesting supply-chain security changes :)

gabibguti commented 9 months ago

Hey! Friendly ping here. Do you think it would be useful to add a security policy to the repository? If not we can close as not planned, otherwise I will close the issue in 2 months.