| 1 | # Security Policy |
| 2 | |
| 3 | The smbCloud team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings, and we will make every effort to acknowledge your contributions. |
| 4 | |
| 5 | ## Supported Versions |
| 6 | |
| 7 | This action is versioned by Git tag. Security patches are provided for the latest major version tag (e.g. `v1`). Please pin to a major version tag (or a specific release) and keep it up to date. |
| 8 | |
| 9 | | Version | Supported | |
| 10 | | ------- | ------------------ | |
| 11 | | `v1` | :white_check_mark: | |
| 12 | | `< v1` | :x: | |
| 13 | |
| 14 | ## Reporting a Vulnerability |
| 15 | |
| 16 | If you discover a security vulnerability, please report it to us by emailing **smbcloud@setoelkahfi.se**. |
| 17 | |
| 18 | **Please do not report security vulnerabilities through public GitHub issues.** |
| 19 | |
| 20 | ### What to Include in a Vulnerability Report |
| 21 | |
| 22 | Please include the following details in your report: |
| 23 | |
| 24 | - A clear and concise description of the vulnerability. |
| 25 | - The version (tag or commit SHA) of the action affected. |
| 26 | - Steps to reproduce the vulnerability. This could include a workflow snippet or a link to a repository with a proof of concept. |
| 27 | - The potential impact of the vulnerability. |
| 28 | - Any potential mitigations or workarounds you are aware of. |
| 29 | |
| 30 | ### Our Process |
| 31 | |
| 32 | 1. When you report a vulnerability, we will acknowledge receipt of your report within 48 hours. |
| 33 | 2. We will investigate the report and determine if it is a valid security issue. |
| 34 | 3. If the vulnerability is accepted, we will work on a patch for the latest version as soon as possible. |
| 35 | 4. We will notify you when the patch is released. |
| 36 | 5. We will publicly disclose the vulnerability after the patch has been released, and we will credit you for the discovery unless you prefer to remain anonymous. |
| 37 | |
| 38 | ## Handling Secrets |
| 39 | |
| 40 | This action reads sensitive inputs (`token`, `ssh-private-key`). Always pass these from [GitHub Actions secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets). Never hardcode them in a workflow file. The action writes them to the runner filesystem with `600` permissions and leaves cleanup to the ephemeral runner. Use a dedicated smbCloud token for CI with only the access it needs. |
| 41 | |
| 42 | We value your contributions to keeping smbCloud secure. |