From 3fafe740b6c5b5a228cfd9dccdf05aa2bdd87033 Mon Sep 17 00:00:00 2001 From: "Piotr P. Karwasz" Date: Tue, 4 Aug 2026 14:21:06 +0200 Subject: [PATCH] docs: route vulnerability reports to the ASF security team SECURITY.md directed reporters to dev@geaflow.apache.org, a public mailing list, which would disclose an unfixed vulnerability at the moment it is reported. Point reporters at security@apache.org instead and link to the ASF reporting and handling policies. Add the ASF submission conventions (plaintext, one finding per e-mail, [SECURITY] subject prefix). Assisted-By: Claude Opus 5 (1M context) --- SECURITY.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 02ddfd373..6b0192125 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,21 +4,16 @@ The Apache Software Foundation takes security issues very seriously. We appreciate your efforts to responsibly disclose your findings. -If you discover a security vulnerability in Apache GeaFlow (Incubating), please report it through one of the following methods: +If you discover a security vulnerability in Apache GeaFlow (Incubating), please report it as follows: ### Email -Please send your security vulnerability report to the Apache Security Team at: - -**[dev@geaflow.apache.org](mailto:dev@geaflow.apache.org)** - -You can also report to the GeaFlow project team directly at: - -**[private@geaflow.apache.org](mailto:private@geaflow.apache.org)** +Please send your security vulnerability report to the Apache Security Team at +[security@apache.org](mailto:security@apache.org?subject=%5BSECURITY%5D%20GeaFlow). ### What to Include -When reporting a security vulnerability, please include the following information: +When reporting a security vulnerability, please send one **plaintext** e-mail **per-finding** including the following information: - **Description**: A detailed description of the vulnerability - **Impact**: The potential impact and severity of the issue @@ -27,6 +22,8 @@ When reporting a security vulnerability, please include the following informatio - **Proof of Concept**: If possible, provide a proof-of-concept or example code - **Suggested Fix**: If you have suggestions for fixing the issue, please include them +See [reporting issues in ASF code](https://security.apache.org/report-code/) for more information. + ### What to Expect - **Acknowledgment**: We will acknowledge receipt of your vulnerability report within 3 business days @@ -34,6 +31,8 @@ When reporting a security vulnerability, please include the following informatio - **Credit**: If you wish, we will credit you in the security advisory when the issue is fixed - **Timeline**: We aim to address critical security issues as quickly as possible, typically within 90 days +See our [security handling policy](https://www.apache.org/security/committers.html#possible). + ### Responsible Disclosure We kindly ask that you: