Create SECURITY.md (#72557)
diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..de0ac46 --- /dev/null +++ b/SECURITY.md
@@ -0,0 +1,56 @@ +# Security Policy + +## Supported Versions + +We commit to publishing security updates for the version of Flutter currently +on the `stable` branch. + +## Reporting a Vulnerability + +To report a vulnerability, please e-mail `security@flutter.dev` with a description of the issue, +the steps you took to create the issue, affected versions, and if known, mitigations for the issue. + +We should reply within three working days, probably much sooner. + +We use GitHub's security advisory feature to track open security issues. You should expect +a close collaboration as we work to resolve the issue you have resolved. Please reach out to +`security@flutter.dev` again if you do not receive prompt attention and regular updates. + +You may also reach out to the team via our public [Discord] chat channels; however, please make +sure to e-mail `security@flutter.dev` when reporting an issue, and avoid revealing information about +vulnerabilities in public if that could put users at risk. + +## Process + +This section describes the process used by the Flutter team when handling vulnerability reports. + +Vulnerability reports are received via the `security@flutter.dev` e-mail alias. Certain team members +who have been designated the "vulnerability management team" receive these e-mails. When receiving +such an e-mail, they will: + +0. Reply to the e-mail acknowledging its receipt, cc'ing `security@flutter.dev` so that the other + members of the team are aware that they are handling the issue. +1. Create a new [security advisory](https://github.com/flutter/flutter/security/advisories/new). + One must be one of the repo admins to do this. Vulnerability management team members who are not + also a repo admin will reach out to the repo admins until they find one who can create the advisory. + The repo admins who are also vulnerability management team members are @Hixie, @tvolkert, and @pcsosinski. +2. [Add the reporter](https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/adding-a-collaborator-to-a-security-advisory) + to the security advisory so that they can get updates. +3. Reopen https://github.com/flutter/flutter/issues/72555 to ensure that security vulnerabilities + will be checked during critical triage. +4. Inform the relevant team lead, adding them to the security advisory. +5. If the security issue does not yet have a CVE number, they will, as a Googler, see go/cve-request to + establish one. + +As the fix is being developed, they will then reach out to the reporter to ask them if they would like to be involved +and whether they would like to be credited. For credit, the GitHub security advisory UI has a field +that allows contributors to be credited. + +When the issue is resolved, they will contact the release team and our PR team to coordinate the publication of the security advisory. + +Security issues have the equivalent of a P0 priority level, but (other than via issue 72555) are +not tracked explicitly in the issue database. This means that we attempt to fix them as quickly as possible. + +For more information on security advisories, see [the GitHub documentation](https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/managing-security-vulnerabilities-in-your-project). + +If team members need additional help from Google, as a Googler, they can see go/vuln.