1 file changed
+38
SECURITY.md
new
+38
@@ -0,0 +1,38 @@
1
+# Security Policy
2
+
3
+The `smbcloud-cli` team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings, and we will make every effort to acknowledge your contributions.
4
+
5
+## Supported Versions
6
+
7
+As the project is in its early stages (pre-1.0), security patches will only be provided for the most recent releases. Please ensure you are using the latest version.
8
+
9
+| Version | Supported |
10
+| ------- | ------------------ |
11
+| 0.3.x | :white_check_mark: |
12
+| < 0.3.0 | :x: |
13
+
14
+## Reporting a Vulnerability
15
+
16
+If you discover a security vulnerability, please report it to us by emailing **smbcloud@setoelkahfi.se**.
17
+
18
+**Please do not report security vulnerabilities through public GitHub issues.**
19
+
20
+### What to Include in a Vulnerability Report
21
+
22
+Please include the following details in your report:
23
+
24
+- A clear and concise description of the vulnerability.
25
+- The version of `smbcloud-cli` affected (e.g., 0.3.22).
26
+- Steps to reproduce the vulnerability. This could include a code snippet, a series of commands, or a link to a repository with a proof of concept.
27
+- The potential impact of the vulnerability.
28
+- Any potential mitigations or workarounds you are aware of.
29
+
30
+### Our Process
31
+
32
+1. When you report a vulnerability, we will acknowledge receipt of your report within 48 hours.
33
+2. We will investigate the report and determine if it is a valid security issue.
34
+3. If the vulnerability is accepted, we will work on a patch for the latest version as soon as possible.
35
+4. We will notify you when the patch is released.
36
+5. We will publicly disclose the vulnerability after the patch has been released, and we will credit you for the discovery unless you prefer to remain anonymous.
37
+
38
+We value your contributions to keeping `smbcloud-cli` secure.