snowflakedb / gosnowflake

Go Snowflake Driver
Apache License 2.0
292 stars 122 forks source link

Update security tab #1076

Closed danMateer closed 5 months ago

danMateer commented 6 months ago

Description

This adds a security policy to the Go driver.

This update bears no changes to the driver's features and functionality.

The policy was taken directly from Snowflake Connector for Python's security policy which I'm assuming may be approved language. But if possible and practical, I recommend updating it to something like this (below). If the version below looks good to you and we can use it, just let me know and I'll update the diff.

I recommend the snippet version below to help make sure...

  1. contributors new to this GH feature don't both submit to directly to Snowflake (good) - and - open a PR/Issue (bad).
  2. contributors sending potential security problems in have a basic guide right in front of them as a reminder of helpful info to include.
## Reporting Security Issues
**Please do not report security vulnerabilities through public GitHub issues.** Instead, please refer to the Snowflake [HackerOne program](https://hackerone.com/snowflake?type=team) for our security policies and for reporting any security vulnerabilities.

For other security related questions and concerns, please contact the Snowflake security team at security@snowflake.com

You should receive a prompt response. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:

  * Type of issue (e.g. missing encryption of sensitive data, SQL injection, cross-site scripting, etc.)
  * Full paths of source file(s) related to the manifestation of the issue
  * The location of the affected source code (tag/branch/commit or direct URL)
  * Any special configuration required to reproduce the issue
  * Step-by-step instructions to reproduce the issue
  * Proof-of-concept or exploit code (if possible)
  * Impact of the issue, including how an attacker might exploit the issue

This information will help us expedite response and any appropriate remediation.

## Preferred Languages
We prefer all communications to be in English.

Checklist

github-actions[bot] commented 6 months ago

CLA Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.


I have read the CLA Document and I hereby sign the CLA


1 out of 2 committers have signed the CLA.
:white_check_mark: (sfc-gh-mhofman)[https://github.com/sfc-gh-mhofman]
:x: @danMateer
You can retrigger this bot by commenting recheck in this Pull Request

sfc-gh-mhofman commented 5 months ago

Thank you @danMateer for this PR. We will keep it simple as in the mentioned Snowflake Connector for Python's security policy

sfc-gh-pfus commented 5 months ago

Hi @danMateer , can you accept our CLA?

sfc-gh-pfus commented 5 months ago

@danMateer Because of lack of your acceptance on CLA I had to create another PR: https://github.com/snowflakedb/gosnowflake/pull/1099 I marked you as a co-author though. Thanks for you suggestion!