From 0360a4801b512f79236e1fc811502ee70d36b48a Mon Sep 17 00:00:00 2001 From: Yanzhao Zhang Date: Tue, 14 May 2024 22:51:28 -0700 Subject: [PATCH] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 7f9ea5d7c3..0b4acaed5b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ This document outlines SONiC vulnerability reporting and management process. SONiC is a popular choice of cloud providers, enterprises, telecom providers, web service providers and others to build their digital infrastructure. The security of SONiC is vital for the safety and reliability of our digital transformation. The strong and active cooperation among SONiC community members is key to securing SONiC. This process will be shared through https://github.com/sonic-net/SONiC/SECURITY.md file after TSC approval. The diagram below illustrates the high-level workflow: ![](./images/security-process/security.png) ## 1.Report SONiC Vulnerability -As a SONiC community member, it is your responsibility to report the discovered vulnerabilities before public disclosure. If you want to report a vulnerability, please use the template suggested by SONiC security committee, encrypt your email and privately send it to security@lists.sonicfoundation.dev. Only SONiC security committee members can access the information in this security mailing list, and they also watch over this mailing list. When someone reports a new vulnerability, SONiC security committee will assist with the vulnerability assessment, coordinate on the mitigation and fix. If you have a suggested fix or mitigation, please include it in your report. Exploit instruction is very useful and will be kept confidential unless it is already public (published to the CVE® database or other publicly accessible websites). SONiC security committee may seek help from SONiC repo maintainers or other domain experts to look into the vulnerability and prepare a mitigation/fix. The collaboration and communication will be private. +As a SONiC community member, it is your responsibility to report the discovered vulnerabilities before public disclosure. If you want to report a vulnerability, please use the template suggested by SONiC security committee, encrypt your email and privately send it to security@lists.sonicfoundation.dev. Only SONiC security committee members can access the information in this security mailing list, and they also watch over this mailing list. When someone reports a new vulnerability, SONiC security committee will assist with the vulnerability assessment, coordinate on the mitigation and fix. If you have a suggested fix or mitigation, please include it in your report. Exploit instruction is very useful and will be kept confidential unless it is already public (published to the CVE® database or other publicly accessible websites and mail lists). SONiC security committee may seek help from SONiC repo maintainers or other domain experts to look into the vulnerability and prepare a mitigation/fix. The collaboration and communication will be private. We appreciate security researchers and SONiC users that report vulnerabilities to the SONiC Open Source Community. All reports will be investigated thoroughly by the SONiC security committee. ## 2.Vulnerability Disclosure Once a mitigation/fix is reviewed and approved by SONiC security committee, the vulnerability disclosure process starts.