mirror of
https://github.com/emqx/neuron.git
synced 2026-10-29 07:06:32 +08:00
69 lines
2.8 KiB
Markdown
69 lines
2.8 KiB
Markdown
# Security Policy
|
|
|
|
We take the security of EMQX Neuron and NeuronEX seriously and appreciate the
|
|
efforts of security researchers who help keep our users safe.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Please do not report security vulnerabilities through public GitHub issues,
|
|
discussions, or pull requests.** Public disclosure before a fix is available puts
|
|
users at risk.
|
|
|
|
Instead, report privately through GitHub's **Private Vulnerability Reporting**:
|
|
|
|
1. Go to the **[Security](https://github.com/emqx/neuron/security)** tab of this
|
|
repository.
|
|
2. Click **Report a vulnerability**.
|
|
3. Fill in the advisory form with the details below.
|
|
|
|
This opens a private channel visible only to the maintainers.
|
|
|
|
### What to include
|
|
|
|
A good report helps us triage quickly. Where possible, please provide:
|
|
|
|
- The affected product and version(s) (e.g. Neuron 2.15.0, NeuronEX 3.9.0), and
|
|
the commit or image digest you tested.
|
|
- The component / code path (file and function, if known).
|
|
- A clear description of the vulnerability and its impact.
|
|
- Step-by-step reproduction instructions, a proof-of-concept, or the exact
|
|
payloads. A reproduction package is welcome.
|
|
- The exact configuration required to trigger it (network binding, TLS mode,
|
|
broker setup, plugins/nodes configured, etc.), and any conditions under which
|
|
the issue does **not** occur.
|
|
- Your assessment of severity, if you have one (e.g. a CVSS vector).
|
|
|
|
## Supported Versions
|
|
|
|
Security fixes are provided for the active release tracks. Older versions should
|
|
be upgraded to a fixed release.
|
|
|
|
| Product | Supported tracks |
|
|
|----------------|------------------|
|
|
| EMQX Neuron | 2.12.x, 2.13.x, 2.14.x, 2.15.x |
|
|
| EMQX NeuronEX | 3.6.x, 3.7.x, 3.8.x, 3.9.x |
|
|
|
|
## Our Process
|
|
|
|
1. **Acknowledgement** — we aim to acknowledge your report within a few business
|
|
days.
|
|
2. **Assessment** — we validate the issue and assess severity (CVSS for the
|
|
published advisory, plus our internal reward tiering where applicable).
|
|
3. **Fix** — we develop and backport the fix across the affected supported tracks.
|
|
4. **Advisory & CVE** — we publish a GitHub Security Advisory (GHSA) and request a
|
|
CVE identifier.
|
|
5. **Disclosure** — to give users time to upgrade, we generally publish the
|
|
advisory **90 days** after the fixed releases are available. We are happy to
|
|
coordinate the disclosure timeline with you.
|
|
6. **Credit** — we credit reporters in the advisory by their preferred name or
|
|
GitHub handle, unless you prefer to remain anonymous.
|
|
|
|
## Scope
|
|
|
|
Vulnerabilities in the Neuron / NeuronEX code and its official plugins are in
|
|
scope. When assessing impact we consider the intended deployment model (for
|
|
example, control-plane and broker interfaces are typically deployed on private,
|
|
trusted networks); please describe the exposure your report assumes.
|
|
|
|
Thank you for helping make the Neuron ecosystem safer.
|