From 93b4598dcdb38b8a5501b3a366c44c15d26799f2 Mon Sep 17 00:00:00 2001 From: Ralph Lange Date: Wed, 22 Jul 2026 17:45:45 +0200 Subject: [PATCH] Add a SECURITY.md file (fixes #898) --- SECURITY.md | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..6b6f7e54f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,49 @@ +# Security Policy + +## Supported Versions + +Security updates and patches are typically applied +to the latest active release series of EPICS Base. +Older, end-of-life release series +do not receive security backports +unless specifically maintained by community contributions. + +| Version | Supported | +| ------- | ------------------ | +| 7.0.x | :white_check_mark: | +| 3.15.x | :white_check_mark: | +| < 3.15 | :x: | + +--- + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities +through public GitHub issues, discussions, pull requests, +or by using EPICS mailing lists.** + +If you discover a security vulnerability within EPICS Base, +please report it privately first, +so that it can be addressed responsibly before public disclosure: + +- **Primary Method:** + Please file a **Private Security** report or issue + via the project's tracking systems + or reach out directly to the EPICS Core developers via the + [EPICS Security email address](mailto:security@epics-controls.org) + or core development contacts. +- **Details to Include:** + - A description of the vulnerability and its potential impact. + - Step-by-step instructions + or proof-of-concept code to reproduce the issue. + - The specific version(s) of EPICS Base affected. +- **AI-Generated Reports:** + - Please double-check findings for hallucinations + before reporting them. + - With the wide availability of AI-based tools, + we will treat many of those reports as public bugs. + However, we still prefer the first report to be private. + +You can expect an acknowledgment of your report, +followed by coordination +on a timeline for investigation and public patching.