From 4b935d97c8a570488c89ffe32a384d317cc9e2b7 Mon Sep 17 00:00:00 2001 From: Miles Date: Wed, 11 Mar 2026 18:19:18 +0800 Subject: [PATCH] docs: add private security disclosure policy Add SECURITY.md and surface reporting guidance in README files. Refs #256 --- README.md | 5 +++++ SECURITY.md | 40 ++++++++++++++++++++++++++++++++++++++++ machinery/README.md | 6 +++++- 3 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 SECURITY.md diff --git a/README.md b/README.md index 08c2283..2997cf5 100644 --- a/README.md +++ b/README.md @@ -65,6 +65,7 @@ There are a myriad of cameras out there (USB, IP and other cameras), and it migh ### Contributing +1. [Security vulnerability reporting](#security-vulnerability-reporting) 1. [Contribute with Codespaces](#contribute-with-codespaces) 2. [Develop and build](#develop-and-build) 3. [Building from source](#building-from-source) @@ -301,6 +302,10 @@ If we talk about video encoders and decoders (codecs) there are 2 major video co Conclusion: depending on the use case you might choose one over the other, and you can use both at the same time. For example you can use H264 (main stream) for livestreaming, and H265 (sub stream) for recording. If you wish to play recordings in a cross-platform and cross-browser environment, you might opt for H264 for better support. +## Security vulnerability reporting + +If you found a potential security vulnerability, please use the private channels described in [SECURITY.md](SECURITY.md). Avoid opening public GitHub issues for sensitive findings. + ## Contribute with Codespaces One of the major blockers for letting you contribute to an Open Source project is to set up your local development machine. Why? Because you might already have some tools and libraries installed that are used for other projects, and the libraries you would need for Kerberos Agent, for example FFmpeg, might require a different version. Welcome to dependency hell... diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d3c188e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,40 @@ +# Security Policy + +## Supported Versions + +We only provide security fixes for the latest release series on the `master` branch. + +## Reporting a Vulnerability + +Please do **not** open a public GitHub issue for potential security vulnerabilities. + +Use one of the private channels below: + +1. Preferred: GitHub private vulnerability reporting + - https://github.com/kerberos-io/agent/security/advisories/new +2. Fallback: Email + - support@kerberos.io + - Optional CC: support@uug.ai + +Please include: + +- A short summary and impact. +- Reproduction steps or proof of concept. +- Affected version(s), commit hash, or deployment details. +- Any proposed mitigation/workaround. +- Your preferred attribution name. + +For faster triage, use this subject format in email: + +`[Security][Kerberos Agent] ` + +## Response Expectations + +- Acknowledgement target: within 3 business days. +- Triage/update target: within 7 business days after acknowledgement. + +If you do not receive a response in time, please resend your report and include your original timestamp. + +## Disclosure and Credits + +We follow coordinated disclosure. After a fix is available, we will credit reporters unless they prefer to stay anonymous. diff --git a/machinery/README.md b/machinery/README.md index 33bea05..1fba113 100644 --- a/machinery/README.md +++ b/machinery/README.md @@ -22,4 +22,8 @@ https://brianmacdonald.github.io/Ethonate/address#0xf4a759C9436E2280Ea9cdd23d314 [**Docker Hub**](https://hub.docker.com/r/kerberos/agent) | [**Documentation**](https://doc.kerberos.io) | [**Website**](https://kerberos.io) -Kerberos Open source (v3) is a cutting edge video surveillance management system made available as Open Source under the MIT License. This means that all the source code is available for you or your company, and you can use, transform and distribute the source code; as long you keep a reference of the original license. Kerberos Open Source (v3) can be used for commercial usage (which was not the case for v2). Read more [about the license here](LICENSE). \ No newline at end of file +Kerberos Open source (v3) is a cutting edge video surveillance management system made available as Open Source under the MIT License. This means that all the source code is available for you or your company, and you can use, transform and distribute the source code; as long you keep a reference of the original license. Kerberos Open Source (v3) can be used for commercial usage (which was not the case for v2). Read more [about the license here](LICENSE). + +## Security reporting + +For sensitive vulnerabilities, use private disclosure channels documented in [../SECURITY.md](../SECURITY.md).