General: Add a security policy (#17339)

* First pass at a security policy * Update SECURITY.md Co-authored-by: Jeremy Herve <[email protected]> * Clarify that all vulns should be reported to h1 * Update policy per suggestions * Update policy per suggestions * Update SECURITY.md * Update SECURITY.md Co-authored-by: Alex Concha <[email protected]> Co-authored-by: Jeremy Herve <[email protected]> Co-authored-by: Alex Concha <[email protected]>
Automattic · Oct 2, 2020 · 122eed9 · 122eed9
1 parent 5767685
commit 122eed9
Showing 1 changed file with 38 additions and 0 deletions.
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,38 @@
+# Security Policy
+
+Full details of the Automattic Security Policy can be found on [automattic.com](https://automattic.com/security/).
+
+## Supported Versions
+
+Generally, only the latest version of Jetpack has continued support. If a critical vulnerability is found in the current version of Jetpack, we may opt to backport any patches to previous versions. 
+
+## Reporting a Vulnerability
+
+[Jetpack](https://jetpack.com/) is an open-source plugin for WordPress. Our HackerOne program covers the plugin software, as well as a variety of related projects and infrastructure.
+
+**For responsible disclosure of security issues and to be eligible for our bug bounty program, please submit your report via the [HackerOne](https://hackerone.com/automattic) portal.**
+
+Our most critical targets are:
+
+* Jetpack and the Jetpack composer packages (all within this repo)
+* Jetpack.com -- the primary marketing site.
+* cloud.jetpack.com -- a management site.
+* wordpress.com -- the shared management site for both Jetpack and WordPress.com sites.
+
+For more targets, see the `In Scope` section on [HackerOne](https://hackerone.com/automattic).
+
+_Please note that the **WordPress software is a separate entity** from Automattic. Please report vulnerabilities for WordPress through [the WordPress Foundation's HackerOne page](https://hackerone.com/wordpress)._
+
+## Guidelines
+
+We're committed to working with security researchers to resolve the vulnerabilities they discover. You can help us by following these guidelines:
+
+*   Follow [HackerOne's disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).
+*   Pen-testing Production:
+    *   Please **setup a local environment** instead whenever possible. Most of our code is open source (see above).
+    *   If that's not possible, **limit any data access/modification** to the bare minimum necessary to reproduce a PoC.
+    *   **_Don't_ automate form submissions!** That's very annoying for us, because it adds extra work for the volunteers who manage those systems, and reduces the signal/noise ratio in our communication channels.
+    *   To be eligible for a bounty, all of these guidelines must be followed.
+*   Be Patient - Give us a reasonable time to correct the issue before you disclose the vulnerability.
+
+We also expect you to comply with all applicable laws. You're responsible to pay any taxes associated with your bounties.