Skip to content

Commit 6f8f571

Browse files
committed
Fill placeholders and fix grammar and typos
1 parent ec1d7f3 commit 6f8f571

File tree

1 file changed

+13
-14
lines changed

1 file changed

+13
-14
lines changed

SECURITY.md

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
## Introduction
44

5-
The Cardano open source project (xxx) is committed to ensuring the security of
5+
The Cardano open source project (formal-ledger-specifications) is committed to ensuring the security of
66
its software and the privacy of its users. We value the contributions
77
of the security community in helping us identify and address
88
vulnerabilities in our code. This Security Vulnerability Disclosure
@@ -13,30 +13,30 @@ how we will respond to and remediate such reports.
1313

1414
### Reporting a Vulnerability
1515

16-
If you discover a security vulnerability in xxxx, we encourage you to
16+
If you discover a security vulnerability in formal-ledger-specifications, we encourage you to
1717
responsibly disclose it to us. To report a vulnerability, please use
1818
the [private reporting form on
19-
GitHub](https://github.com/input-output-hk/mithril/security/advisories/new)
19+
GitHub](https://github.com/IntersectMBO/formal-ledger-specifications/security/advisories/new)
2020
to draft a new _Security advisory_.
2121

2222
Please include as much details as needed to clearly qualify the issue:
2323

2424
- A description of the vulnerability and its potential impact.
2525
- Steps to reproduce the vulnerability.
26-
- The version of `xxxx` package where the vulnerability exists.
26+
- The version of the `formal-ledger-specifications` package where the vulnerability exists.
2727
- Any relevant proof-of-concept or exploit code (if applicable).
2828

2929
### Processing Vulnerability
3030

3131
1. **Acknowledgment**: The team acknowledges the receipt of your report
3232
within 3 business days by commenting on the issue reporting it or replying to email.
3333

34-
2. **Validation**: The team investigates the issue and either _reject_ or _validate_ the
34+
2. **Validation**: The team investigates the issue and either _rejects_ or _validates_ the
3535
reported vulnerability.
3636

3737
a. **Rejection**: If the team rejects the report, detailed explanations will be provided by email or commenting on the relevant issue and the latter will be made public and closed as `Won't fix`.
3838

39-
b. **Acceptance**: If the team accepts the report, a CVE identifier will be requested through GitHub and a [private fork](https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/collaborating-in-a-temporary-private-fork-to-resolve-a-repository-security-vulnerability) opened to work on a fix to the issue
39+
b. **Acceptance**: If the team accepts the report, a CVE identifier will be requested through GitHub and a [private fork](https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/collaborating-in-a-temporary-private-fork-to-resolve-a-repository-security-vulnerability) will be opened to work on a fix to the issue.
4040

4141
3. **Resolution**: The team works to resolve the vulnerability in a
4242
timely manner. The timeline for resolution will depend on the
@@ -50,15 +50,15 @@ Please include as much details as needed to clearly qualify the issue:
5050

5151
5. **Fixing Issue**: The team agrees on the fix, the announcement, and the release schedule with the reporter. If the reporter is not responsive in a reasonable time frame this should not block the team from moving to the next steps particularly in the face of a high impact or high severity issue.
5252

53-
a. **Mitigation**: Depending on the severity and criticity of the issue, the team can decide to disclose the issue publicly in the absence of a fix _if and only if_ a clear, simple, and effective mitigation plan is defined. This _must_ include instructions for users and operators of the software, and a time horizon at which the issue will be properly fixed (eg. version number).
53+
a. **Mitigation**: Depending on the severity and criticality of the issue, the team can decide to disclose the issue publicly in the absence of a fix _if and only if_ a clear, simple, and effective mitigation plan is defined. This _must_ include instructions for users and operators of the software, and a time horizon at which the issue will be properly fixed (eg. version number).
5454

5555
b. **Fix**: When a fix is available and approved, it should be merged and made available as quickly as possible:
5656

57-
- All commits to the private repository are squashed into a single commit whose description _should not_ make any reference it relates to a security vulnerability
57+
- All commits to the private repository are squashed into a single commit whose description _should not_ make any reference that it relates to a security vulnerability
5858
- A new Pull Request is created with this single commit
59-
- This PR's review and merging is expedited as all the work as already been done
59+
- This PR's review and merging is expedited as all the work has already been done
6060

61-
6. **Release**: The team creates and publish a release that includes the fix
61+
6. **Release**: The team creates and publishes a release that includes the fix.
6262

6363
7. **Announcement**: Concomitant to the release announcement, the team announces the security vulnerability by making the GitHub issue public. This is the first point that any information regarding the vulnerability is made public.
6464

@@ -89,18 +89,17 @@ report security vulnerabilities to us.
8989

9090
## Contact Information
9191

92-
To report a security vulnerability, please use [GitHub
93-
form]((add project github form for your project)). Should you experience any issues reporting via GitHub or have other questions, Please contact [Security](security@intersectmbo.org).
92+
To report a security vulnerability, please use the [GitHub security advisory form](https://github.com/IntersectMBO/formal-ledger-specifications/security/advisories/new). Should you experience any issues reporting via GitHub or have other questions, please contact [security@intersectmbo.org](mailto:security@intersectmbo.org).
9493

9594
## Revision of Policy
9695

9796
This Security Vulnerability Disclosure Policy may be updated or
9897
revised as necessary. Please check the latest version of this policy
99-
on the [xxxx repository]((add link for your project)).
98+
on the [formal-ledger-specifications repository](https://github.com/IntersectMBO/formal-ledger-specifications).
10099

101100
## Conclusion
102101

103-
The xxxx project greatly appreciates the assistance of the security
102+
The formal-ledger-specifications project greatly appreciates the assistance of the security
104103
community in helping us maintain the security of our software while
105104
upholding the highest standards of privacy. Together, we can work to
106105
identify and address vulnerabilities, ensuring a safer and more secure

0 commit comments

Comments
 (0)