From 77da96780161778bd4b653e231b817fc4d3bdeb8 Mon Sep 17 00:00:00 2001 From: laughingman7743 Date: Mon, 3 Aug 2026 00:16:11 +0900 Subject: [PATCH] Add a security policy Document how to report a vulnerability privately, using GitHub's private vulnerability reporting (now enabled on the repository), so that reports do not arrive as public issues or via a maintainer's personal email. States the supported version, what a useful report contains, and the disclosure process actually followed for CVE-2026-65321: fix privately, release to PyPI, publish the advisory the same day, credit the reporter. No response-time promise is made, since this is community-maintained. Co-Authored-By: Claude Fable 5 --- SECURITY.md | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..cb7ca69e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,40 @@ +# Security Policy + +## Supported versions + +Security fixes are released for the latest version of PyAthena only. There are no backports to +earlier release series, so please upgrade to the latest release before reporting an issue. + +## Reporting a vulnerability + +Please report security vulnerabilities privately, not through a public issue or pull request, +since a public report discloses the problem before a fix is available. + +Use GitHub's private vulnerability reporting: go to the +[Security tab](https://github.com/pyathena-dev/PyAthena/security) of this repository and click +**Report a vulnerability**. This opens a private channel visible only to the maintainers. + +A report is most useful when it includes: + +- the PyAthena version you tested against +- the affected code path, and the API you called to reach it +- steps to reproduce, ideally without requiring a live AWS account +- what an attacker can do with it + +Proof-of-concept code is welcome but not required. Please do not test against AWS accounts or +data that you do not own. + +## What to expect + +This is a community-maintained project, so response times depend on maintainer availability. +The usual process is: + +1. The report is acknowledged and the affected code path is confirmed. +2. A fix is prepared privately, along with regression tests. +3. The fix is released to PyPI, and a + [GitHub Security Advisory](https://github.com/pyathena-dev/PyAthena/security/advisories) is + published the same day, so that users are notified only once an upgrade is available. +4. Reporters are credited in the advisory unless they ask not to be. + +If a CVE ID is warranted, it is requested through GitHub or coordinated with the CNA that +assigned it.