mirror of
https://gitee.com/pnoker/iot-dc3.git
synced 2026-10-31 18:21:58 +08:00
pnoker
50c6de9438
Prose rewrapping and table reflow from a project-wide markdown pass;
no content changes. Also reverts two formatter mistakes: restores
MD5(password) in dc3-web/AGENTS.md and drops spurious spaces after
CJK punctuation in README.zh.md / README.ja.md.
Covers root guides (AGENTS/CONTRIBUTING/SECURITY/README.*), module
READMEs across dc3-api/center/common/driver/e2e/gateway, the nginx
guide, dc3/doc/{README,TITLE}.md, and dc3-web docs.
52 lines
2.3 KiB
Markdown
52 lines
2.3 KiB
Markdown
# Security Policy
|
|
|
|
> :lock: **Note:** iot-dc3 is a distributed Internet of Things (IoT) platform that involves device access, data
|
|
> collection, and command dispatch. Security issues not only affect
|
|
> system operation but may also cause data or control risks. Please pay close attention to security configuration and
|
|
> version updates.
|
|
|
|
## Supported Versions
|
|
|
|
> We usually provide security patches and updates only for the mainline versions that are currently actively maintained.
|
|
|
|
The following table lists the iot-dc3 versions that are currently supported with security updates:
|
|
|
|
| Version | Supported |
|
|
|----------|--------------------|
|
|
| 2025.9.x | :white_check_mark: |
|
|
| 2025.6.x | :white_check_mark: |
|
|
| 2025.x.x | :white_check_mark: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
> We take security issues very seriously.
|
|
> If a vulnerability is verified, we will fix it as soon as possible and disclose the fix information in the release
|
|
> notes.
|
|
|
|
If you find a potential security vulnerability while using **iot-dc3**, **do not disclose it publicly in issues or
|
|
discussion areas**, but report it through the following private channels:
|
|
|
|
1. **GitHub Security Advisory (preferred)**:
|
|
Use [private vulnerability reporting](https://github.com/pnoker/iot-dc3/security/advisories/new) on GitHub — this is
|
|
the recommended channel and reaches the maintainers directly with a tracked, private workflow.
|
|
|
|
2. **Email report**:
|
|
Send an email to the project maintenance team, and please include the keyword `Security Vulnerability` in the subject
|
|
line.
|
|
|
|
3. **Direct message report**:
|
|
You can directly contact the project maintainers through the private message function on Gitee or GitHub.
|
|
|
|
## Security Best Practices
|
|
|
|
To ensure the security and stability of the iot-dc3 platform in production environments, it is recommended to follow
|
|
these practices:
|
|
|
|
- :white_check_mark: Always use supported versions;
|
|
- :no_entry_sign: Do not expose core communication ports (such as MQTT, TCP, Modbus gateways) directly to the public
|
|
network;
|
|
- :lock: Use secure authentication mechanisms and enable HTTPS / SSL encryption;
|
|
- :arrows_counterclockwise: Regularly update system dependencies and Docker images;
|
|
- :jigsaw: Only authorize trusted devices and users to access the system;
|
|
- :bar_chart: Apply the principle of least privilege and perform access auditing on external interfaces.
|