59 lines
2.0 KiB
Markdown
59 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
We currently support the following versions with security updates:
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 1.0.x | :white_check_mark: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We take the security of TechIRCd seriously. If you believe you have found a security vulnerability, please report it to us as described below.
|
|
|
|
**Please do not report security vulnerabilities through public GitHub issues.**
|
|
|
|
Instead, please report them via email to: security@techircd.org (or the maintainer's email)
|
|
|
|
Please include the following information (as much as you can provide) to help us better understand the nature and scope of the possible issue:
|
|
|
|
- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
|
|
- Full paths of source file(s) related to the manifestation of the issue
|
|
- The location of the affected source code (tag/branch/commit or direct URL)
|
|
- Any special configuration required to reproduce the issue
|
|
- Step-by-step instructions to reproduce the issue
|
|
- Proof-of-concept or exploit code (if possible)
|
|
- Impact of the issue, including how an attacker might exploit the issue
|
|
|
|
This information will help us triage your report more quickly.
|
|
|
|
## Preferred Languages
|
|
|
|
We prefer all communications to be in English.
|
|
|
|
## Response Time
|
|
|
|
We will respond to your report within 48 hours and provide regular updates at least every 72 hours.
|
|
|
|
## Security Measures
|
|
|
|
TechIRCd implements several security measures:
|
|
|
|
- Input validation and sanitization
|
|
- Flood protection and rate limiting
|
|
- Connection timeout management
|
|
- Panic recovery mechanisms
|
|
- Memory usage monitoring
|
|
- Secure configuration validation
|
|
|
|
## Responsible Disclosure
|
|
|
|
We follow responsible disclosure practices:
|
|
|
|
1. **Report**: Submit vulnerability report privately
|
|
2. **Acknowledge**: We acknowledge receipt within 48 hours
|
|
3. **Investigate**: We investigate and develop a fix
|
|
4. **Coordinate**: We coordinate disclosure timeline with reporter
|
|
5. **Release**: We release security update and public disclosure
|