portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update Security policy to be more precise about vulns

Browse source
This commit is contained in:
Riccardo Schirone 2021-08-25 13:13:37 +02:00 committed by GitHub
parent 31d4143a93
commit 0586901729
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
SECURITY.md
View file

@ -1,17 +1,23 @@
# Security Policy
## Supported Versions
## Scope and Supported Versions
| Version | Supported |
| ---------------- | ------------------ |
| latest-release | :white_check_mark: |
| * | :x: |
Rizin is a user-space Command Line Interface (CLI) tool that isn't considered a high-availability service. As such, issues that impact Rizin's availability will not be considered as vulnerabilities by the security team. Such issues include, but are not limited to:
- NULL Pointer Dereference
- Memory Exhaustion
Issues that can leak non-sensitive memory contents (e.g memory addresses and values, etc.) should be demonstrated to be usable by an attacker and will be considered on a case-by-case basis.
## Reporting a Vulnerability
Security issues in the Rizin repository should be reported by email to security@rizin.re. Your email will be delivered to a small security team that will handle the report. Your email will be acknowledged within 48 hours, and you'll receive a more detailed response to your email within 72 hours indicating the next steps in handling your report.
For your convenience, we accept reports written in one of the languages listed on our [security.txt](https://rizin.re/.well-known/security.txt) page, but we prefer reports in English.
For your convenience, we accept reports written in one of the languages listed on our [security.txt](https://rizin.re/.well-known/security.txt) page, but we prefer reports in English. Please try to always include in your report an attack scenario, showing how the issue can affect Rizin users.
If you have not received a reply to your email within 48 hours, or have not heard from the security team for the past week, there are a few steps you can take (in order):