Feng Ruohang
15090dc4fd
Remove migrated investigation and security documents, repair their incoming links, and align the English/Chinese READMEs with current module and release boundaries. Track AGENTS.md as the shared repository guide and make CLAUDE.md import it; keep working artifacts outside the repository. Publish pgsty/silo.pgsty.com commit c7682185e2832b981629e1c17aef74fc778c6ca1 before publishing this cleanup: the new documentation routes are not live yet. Validation: make rebrand-guard; 92 Markdown files checked for deletion-induced broken relative paths; 199 source-to-site references and anchors resolve in the paired site build; git diff --check. Signed-off-by: Feng Ruohang <rh@vonng.com>
1.6 KiB
Vulnerability Management Policy
This document describes how the Silo maintainers investigate, assess, and remediate reported vulnerabilities affecting this fork, any directly shipped component, or a direct / indirect dependency used by this repository.
Scope
This policy covers vulnerability reports opened by repository maintainers or external third parties against Silo itself, its release artifacts, or dependencies that materially affect this fork.
It defines the information needed for triage and the expected remediation workflow for supported fixes.
Vulnerability Management Process
A useful vulnerability report should contain the following information:
- The project / component that contains the reported vulnerability.
- A description of the vulnerability. In particular, the type of the reported vulnerability and how it might be exploited. Alternatively, a well-established vulnerability identifier, such as a CVE or GHSA ID, can be used instead.
Based on the report, the Silo maintainers investigate:
- Whether the reported vulnerability exists.
- The conditions that are required such that the vulnerability can be exploited.
- Which releases, branches, or deployment paths are affected.
- The steps required to fix the vulnerability.
If the vulnerability exists in this fork itself, the maintainers will, when feasible, fix the issue or implement reasonable countermeasures such that the vulnerability can no longer be exploited. Fork-specific upgrade notes and security advisories are published in the security advisory ledger.