Skip to content

Revise security policy and reporting instructions #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
prasanna-anchorage wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Revise security policy and reporting instructions #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# Security Policy

## Supported Versions

All versions are expected to be supported

Copilot AI Nov 14, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The statement "All versions are expected to be supported" is vague and potentially misleading. Security policies should clearly specify which versions receive security updates. Consider being more explicit, such as:

  • "We support the latest release with security updates"
  • "We support the last N major/minor versions"
  • "Only the current major version (vX.x.x) receives security updates"

This clarity helps users understand their security support window and make informed decisions about upgrading.

Suggested change
All versions are expected to be supported
We support the latest release with security updates. Older versions may not receive security updates.

Copilot uses AI. Check for mistakes.

## Reporting a Vulnerability

Email: security@anchorage.com

Copilot AI Nov 14, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The vulnerability reporting section lacks important details that are typically included in security policies. Consider adding:

  • Expected response time (e.g., "We will respond within 48 hours")
  • Disclosure policy (e.g., responsible disclosure timeline)
  • What information to include in the report
  • Preferred format for reporting (PGP key if encrypted communication is preferred)
  • Whether a bug bounty program exists

This information helps security researchers understand the reporting process and expectations.

Suggested change
Email: security@anchorage.com
If you believe you have found a security vulnerability, please report it to us via email at [security@anchorage.com](mailto:security@anchorage.com).
**Expected Response Time:** We will acknowledge your report within 48 hours and aim to provide a more detailed response within 5 business days.
**Disclosure Policy:** We ask that you follow responsible disclosure practices and allow us reasonable time to investigate and address the issue before any public disclosure. We will keep you informed of our progress and coordinate disclosure timelines as appropriate.
**What to Include in Your Report:** Please provide as much detail as possible, including:
- A description of the vulnerability
- Steps to reproduce the issue
- Potential impact
- Any relevant logs, screenshots, or proof-of-concept code
**Preferred Format for Reporting:** If you wish to encrypt your communication, please use our PGP key below:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: OpenPGP.js v4.10.10
Comment: https://openpgpjs.org

mQENBF9v1XwBCAC3...
-----END PGP PUBLIC KEY BLOCK-----


**Bug Bounty Program:** At this time, we do not offer a public bug bounty program. However, we appreciate your efforts to help us improve our security and may recognize significant contributions.

Copilot uses AI. Check for mistakes.