docs: add SECURITY.md (#9062)
* docs: add SECURITY.md This moves existing security policy from README to SECURITY.md which has a special meaning on Github: https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository * style: editoral fix Co-authored-by: Steve Loeppky <biglep@protocol.ai>
Marcin Rataj committed
Jun 28, 2022 at 18:51 UTC
b6ded334ecf924fd879d0b3e370367d033cd1675
2 files changed
+34
-14
README.md
+14
-14
@@ -47,24 +47,26 @@ Before opening an issue, consider using one of the following locations to ensure
47
- [Other package managers](#other-package-managers)
48
- [Guix](#guix)
49
- [Snap](#snap)
50
- - [macOS package managers](#macos-package-managers)
51
- - [MacPorts](#MacPorts)
52
- - [Nix](#nix-macos)
53
- - [Homebrew](#Homebrew)
50
+ - [macOS package managers](#macos-package-managers)
51
+ - [MacPorts](#macports)
52
+ - [Nix](#nix-macos)
53
+ - [Homebrew](#homebrew)
54
- [Windows package managers](#windows-package-managers)
55
- [Chocolatey](#chocolatey)
56
- [Scoop](#scoop)
57
- - [Install prebuilt binaries](#install-prebuilt-binaries)
57
+ - [Install prebuilt binaries](#install-prebuilt-binaries)
58
- [Build from Source](#build-from-source)
59
- [Install Go](#install-go)
60
- [Download and Compile IPFS](#download-and-compile-ipfs)
61
- - [Cross Compiling](#cross-compiling)
62
- - [OpenSSL](#openssl)
61
+ - [Cross Compiling](#cross-compiling)
62
+ - [OpenSSL](#openssl)
63
- [Troubleshooting](#troubleshooting)
64
- [Updating go-ipfs](#updating-go-ipfs)
65
+ - [Using ipfs-update](#using-ipfs-update)
66
+ - [Downloading IPFS builds using IPFS](#downloading-ipfs-builds-using-ipfs)
67
- [Getting Started](#getting-started)
66
- - [Some things to try](#some-things-to-try)
68
- [Usage](#usage)
69
+ - [Some things to try](#some-things-to-try)
70
- [Troubleshooting](#troubleshooting-1)
71
- [Packages](#packages)
72
- [Development](#development)
@@ -78,11 +80,7 @@ Before opening an issue, consider using one of the following locations to ensure
80
81
## Security Issues
82
81
-The IPFS protocol and its implementations are still in heavy development. This means that there may be problems in our protocols, or there may be mistakes in our implementations. And -- though IPFS is not production-ready yet -- many people are already running nodes in their machines. So we take security vulnerabilities very seriously. If you discover a security issue, please bring it to our attention right away!
82
-
83
-If you find a vulnerability that may affect live deployments -- for example, by exposing a remote execution exploit -- please send your report privately to security@ipfs.io. Please DO NOT file a public issue.
84
-
85
-If the issue is a protocol weakness that cannot be immediately exploited or something not yet deployed, just discuss it openly.
83
+Please follow [`SECURITY.md`](SECURITY.md).
84
85
## Install
86
@@ -168,7 +166,9 @@ $ sudo snap install ipfs
166
167
The snap sets `IPFS_PATH` to `SNAP_USER_COMMON`, which is usually `~/snap/ipfs/common`. If you want to use `~/.ipfs` instead, you can bind-mount it to `~/snap/ipfs/common` like this:
168
171
-```sudo mount --bind ~/.ipfs ~/snap/ipfs/common```
169
+```
170
+$ sudo mount --bind ~/.ipfs ~/snap/ipfs/common
171
+```
172
173
If you want something more sophisticated to escape the snap confinement, we recommend using a different method to install `go-ipfs` so that it is not subject to snap confinement.
174
SECURITY.md
new
+20
@@ -0,0 +1,20 @@
1
+# Security Policy
2
+
3
+The IPFS protocol and its implementations are still in heavy development. This
4
+means that there may be problems in our protocols, or there may be mistakes in
5
+our implementations. We take security
6
+vulnerabilities very seriously. If you discover a security issue, please bring
7
+it to our attention right away!
8
+
9
+## Reporting a Vulnerability
10
+
11
+If you find a vulnerability that may affect live deployments -- for example, by
12
+exposing a remote execution exploit -- please **send your report privately** to
13
+security@ipfs.io. Please **DO NOT file a public issue**.
14
+
15
+If the issue is a protocol weakness that cannot be immediately exploited or
16
+something not yet deployed, just discuss it openly.
17
+
18
+## Reporting a non security bug
19
+
20
+For non-security bugs, please simply file a GitHub [issue](https://github.com/ipfs/go-ipfs/issues/new/choose).