diff options
| author | Olivier Dony <odo@odoo.com> | 2019-05-24 15:10:55 +0200 |
|---|---|---|
| committer | Olivier Dony <odony@users.noreply.github.com> | 2019-05-24 15:14:41 +0200 |
| commit | 3845e0ff61fb6075d1ed6c6c5cd3c26ce5f6d510 (patch) | |
| tree | 7d71dd1f2e5769a1722a07065e077f93a234e2c3 /SECURITY.md | |
| parent | 345a5a4aa816c146a30fe0bd07446eb9ee351a45 (diff) | |
[ADD] Add security policy for our GitHub project
To be displayed on https://github.com/odoo/odoo/security/policy
Diffstat (limited to 'SECURITY.md')
| -rw-r--r-- | SECURITY.md | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000000..98eb36db26e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,40 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| 12.0 | :white_check_mark: | +| 11.0 | :white_check_mark: | +| 10.0 | :white_check_mark: | +| <=9.0 | :x: | + +## Reporting a Vulnerability + +Please share privately the details of your security vulnerability by contacting our Security Team: +[Contact Info](https://www.odoo.com/security-report) + +Make sure to include as much information as possible, with the detailed steps to reproduce the problem, +the versions that are affected, the expected results and actual results, and any other information that +might help us react faster and more efficiently. + +We tend to prefer _text-based descriptions_ accompanied with a proof-of-concept script/exploit, rather +than screenshots and videos. + +Our [Responsible Disclosure](https://www.odoo.com/security-report) page gives an overview of the +process, including: + + - Our Incident Response Procedure (what will happen after you report an issue) + - Our Rules (what you can and cannot do while researching security issues) + - Guidelines with **DO REPORT** and **DO NOT REPORT** issues + (what kind of issues will be accepted/rejected) + + +## Important note + +We receive a majority of security reports that have little to no impact on the security of Odoo or +the Odoo Cloud, and we ultimately have to reject them. To avoid a disappointing experience when +contacting us, please try to put together a proof-of-concept attack and take a critical look at +what's really at risk. +If the proposed attack scenario turns out unrealistic, your report will probably be rejected. +Also be sure to review our list of [non-qualifying issues](https://www.odoo.com/security-report#what). |