mirror of
https://github.com/pgsty/minio.git
synced 2026-09-19 00:38:26 +03:00
Feng Ruohang
15090dc4fd
Remove migrated investigation and security documents, repair their incoming links, and align the English/Chinese READMEs with current module and release boundaries. Track AGENTS.md as the shared repository guide and make CLAUDE.md import it; keep working artifacts outside the repository. Publish pgsty/silo.pgsty.com commit c7682185e2832b981629e1c17aef74fc778c6ca1 before publishing this cleanup: the new documentation routes are not live yet. Validation: make rebrand-guard; 92 Markdown files checked for deletion-induced broken relative paths; 199 source-to-site references and anchors resolve in the paired site build; git diff --check. Signed-off-by: Feng Ruohang <rh@vonng.com>
38 lines
1.6 KiB
Markdown
38 lines
1.6 KiB
Markdown
# Vulnerability Management Policy
|
|
|
|
This document describes how the Silo maintainers investigate,
|
|
assess, and remediate reported vulnerabilities affecting this fork, any
|
|
directly shipped component, or a direct / indirect dependency used by this
|
|
repository.
|
|
|
|
## Scope
|
|
|
|
This policy covers vulnerability reports opened by repository maintainers or
|
|
external third parties against Silo itself, its release artifacts, or
|
|
dependencies that materially affect this fork.
|
|
|
|
It defines the information needed for triage and the expected remediation
|
|
workflow for supported fixes.
|
|
|
|
## Vulnerability Management Process
|
|
|
|
A useful vulnerability report should contain the following information:
|
|
|
|
- The project / component that contains the reported vulnerability.
|
|
- A description of the vulnerability. In particular, the type of the
|
|
reported vulnerability and how it might be exploited. Alternatively,
|
|
a well-established vulnerability identifier, such as a CVE or GHSA ID, can
|
|
be used instead.
|
|
|
|
Based on the report, the Silo maintainers investigate:
|
|
|
|
- Whether the reported vulnerability exists.
|
|
- The conditions that are required such that the vulnerability can be exploited.
|
|
- Which releases, branches, or deployment paths are affected.
|
|
- The steps required to fix the vulnerability.
|
|
|
|
If the vulnerability exists in this fork itself, the maintainers will, when
|
|
feasible, fix the issue or implement reasonable countermeasures such that the
|
|
vulnerability can no longer be exploited. Fork-specific upgrade notes and
|
|
security advisories are published in [the security advisory ledger](https://silo.pgsty.com/about/security-advisories/).
|