75 lines
2.0 KiB
Markdown
75 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
Thank you for helping keep Doktainer and its users secure.
|
|
|
|
## Supported Versions
|
|
|
|
The following versions currently receive security updates:
|
|
|
|
| Version | Supported |
|
|
| -------------------------- | --------- |
|
|
| Latest Milestone Release | ✅ |
|
|
| Previous Milestone Release | ✅ |
|
|
| Older Releases | ❌ |
|
|
|
|
As Doktainer is currently in the pre-1.0 phase, users are encouraged to always upgrade to the latest available release.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability, please do **not** create a public GitHub Issue.
|
|
|
|
Instead, report the vulnerability privately through:
|
|
|
|
- GitHub Security Advisories (preferred)
|
|
- GitHub Private Vulnerability Reporting
|
|
|
|
Please include:
|
|
|
|
- A description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested mitigation (if available)
|
|
|
|
## Response Process
|
|
|
|
After receiving a report, the Doktainer maintainers will:
|
|
|
|
1. Acknowledge receipt of the report.
|
|
2. Investigate and validate the issue.
|
|
3. Develop and test a fix.
|
|
4. Release a security update if necessary.
|
|
5. Publicly disclose the vulnerability after a fix is available.
|
|
|
|
## Scope
|
|
|
|
Examples of security vulnerabilities include:
|
|
|
|
- Authentication bypass
|
|
- Privilege escalation
|
|
- Remote code execution
|
|
- Command injection
|
|
- Server-side request forgery (SSRF)
|
|
- Sensitive information disclosure
|
|
- Container escape vulnerabilities
|
|
- Insecure secret handling
|
|
|
|
## Disclosure Policy
|
|
|
|
Please allow maintainers a reasonable amount of time to investigate and address reported vulnerabilities before publicly disclosing them.
|
|
|
|
Responsible disclosure helps protect Doktainer users and infrastructure operators.
|
|
|
|
## Security Updates
|
|
|
|
Security fixes may be released as maintenance releases:
|
|
|
|
- v0.x.1
|
|
- v0.x.2
|
|
- v0.x.3
|
|
|
|
or, when necessary, included in the next milestone release.
|
|
|
|
## Acknowledgements
|
|
|
|
We appreciate responsible security researchers and community members who help improve the security of Doktainer.
|