From ab0ddcf0b4dc64276bd0e966bd7fac7a207748b0 Mon Sep 17 00:00:00 2001 From: Gary O'Neall Date: Tue, 29 Sep 2026 14:56:47 -0700 Subject: [PATCH 1/4] Add SECURITY.md for vulnerability reporting Added a security policy outlining reporting mechanisms for vulnerabilities and response processes. --- SECURITY.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..73cbe76 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,25 @@ +# Security Policy + +## CRA stewardship: + +This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described below, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project’s emergency security reporting mechanisms as appropriate. + +## Reporting a Vulnerability + +We take the security of this project seriously. If you believe you have found a security vulnerability, please do not report it publicly through a GitHub issue. + +Instead, please send a confidential email with details of the vulnerability and a reference to this tool-java repository to: +[spdx-tools-security@lists.spdx.org](mailto:spdx-tools-security@lists.spdx.org) + +### What to Include +To help us quickly understand and address the issue, please include as much of the following information as possible: +* Type of issue (e.g., buffer overflow) +* Full paths of source file(s) related to the manifestation of the issue +* Any special configuration required to reproduce the issue +* Step-by-step instructions or a proof-of-concept to reproduce the issue +* Impact of the issue, including how an attacker could exploit it + +### Response & Handling Process +* **Acknowledgment:** We will acknowledge receipt of your vulnerability report within a reasonable timeframe. +* **Investigation:** The maintainers will investigate the issue and determine its impact and scope. +* **Fix & Disclosure:** Once a fix is prepared and tested, a security update will be released. We appreciate your cooperation in keeping the vulnerability confidential until a patch is publicly available. From ecc822658788006a0e5364f289b41f2d0f1bde1c Mon Sep 17 00:00:00 2001 From: Gary O'Neall Date: Wed, 30 Sep 2026 18:11:55 -0700 Subject: [PATCH 2/4] Update SECURITY.md Co-authored-by: Arthit Suriyawongkul --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 73cbe76..7d4af76 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,6 +1,6 @@ # Security Policy -## CRA stewardship: +## CRA Stewardship This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described below, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project’s emergency security reporting mechanisms as appropriate. From 4f41e0bdebd654beadb90e574e9f1343c457c2b0 Mon Sep 17 00:00:00 2001 From: Gary O'Neall Date: Wed, 30 Sep 2026 18:12:19 -0700 Subject: [PATCH 3/4] Update SECURITY.md Co-authored-by: Arthit Suriyawongkul --- SECURITY.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 7d4af76..2a53dfa 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,9 @@ Instead, please send a confidential email with details of the vulnerability and [spdx-tools-security@lists.spdx.org](mailto:spdx-tools-security@lists.spdx.org) ### What to Include + To help us quickly understand and address the issue, please include as much of the following information as possible: + * Type of issue (e.g., buffer overflow) * Full paths of source file(s) related to the manifestation of the issue * Any special configuration required to reproduce the issue From 1702fe7f7b841d097ae97b24c741f85226e8f729 Mon Sep 17 00:00:00 2001 From: Gary O'Neall Date: Wed, 30 Sep 2026 18:12:35 -0700 Subject: [PATCH 4/4] Update SECURITY.md Co-authored-by: Arthit Suriyawongkul --- SECURITY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SECURITY.md b/SECURITY.md index 2a53dfa..c2be4b4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -22,6 +22,7 @@ To help us quickly understand and address the issue, please include as much of t * Impact of the issue, including how an attacker could exploit it ### Response & Handling Process + * **Acknowledgment:** We will acknowledge receipt of your vulnerability report within a reasonable timeframe. * **Investigation:** The maintainers will investigate the issue and determine its impact and scope. * **Fix & Disclosure:** Once a fix is prepared and tested, a security update will be released. We appreciate your cooperation in keeping the vulnerability confidential until a patch is publicly available.