From 076af957c873a41fbe231f0e4831b30aa300c8b7 Mon Sep 17 00:00:00 2001 From: Jasper Van Date: Sat, 20 Jun 2026 13:25:05 -0400 Subject: [PATCH] Create SECURITY.md for security policy (#471) * Create SECURITY.md for security policy Added a security policy document outlining supported versions and vulnerability reporting. Signed-off-by: Jasper Van * docs: fill in real SECURITY.md policy for ZPan Replace the GitHub default template (placeholder 5.x/4.x versions and boilerplate) with an actual policy: supported 2.x versions, private vulnerability reporting via GitHub Security Advisories, and response-time expectations. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: saltbo * docs: express supported versions relative to latest release Avoid pinning a concrete minor (2.7.x) that goes stale on every release. ZPan ships fixes forward on a single release train and does not backport, so 'latest release only' is both accurate and zero-maintenance. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: saltbo --------- Signed-off-by: Jasper Van Signed-off-by: saltbo Co-authored-by: Claude Opus 4.8 (1M context) --- SECURITY.md | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..ff61649d --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,57 @@ +# Security Policy + +ZPan is an open-source, S3-native file hosting platform. We take the security of +ZPan and its users seriously and appreciate responsible disclosure of any issues. + +## Supported Versions + +Security fixes ship in the latest release only — we do not backport fixes to +older versions. If you are affected by a security issue, please upgrade to the +most recent release. ZPan v1 (the legacy Go implementation on the +[`v1` branch](https://github.com/saltbo/zpan/tree/v1)) is no longer maintained +and receives no security updates. + +| Version | Supported | +| -------------------- | ------------------ | +| Latest 2.x release | :white_check_mark: | +| Older 2.x releases | :x: | +| 1.x (Go, legacy) | :x: | + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub issues, +discussions, or pull requests.** + +Instead, report them privately through GitHub Security Advisories: + +➡️ **[Report a vulnerability](https://github.com/saltbo/zpan/security/advisories/new)** + +This opens a private channel visible only to the maintainers. Please include as +much of the following as you can: + +- The type of issue (e.g. authentication bypass, SSRF, presigned-URL leakage, + injection, privilege escalation) +- The affected component (Cloudflare Workers deployment, Node/Docker deployment, + storage gateway, frontend, etc.) and version +- Step-by-step instructions to reproduce the issue, including any proof-of-concept +- The impact, including how an attacker might exploit it + +## What to Expect + +- **Acknowledgement** — we aim to confirm receipt within **3 business days**. +- **Assessment** — we will investigate and let you know whether the report is + accepted, needs more information, or is declined, typically within **7 days**. +- **Fix & disclosure** — for accepted reports we will work on a fix, keep you + updated on progress, and coordinate a public disclosure (and a GitHub Security + Advisory with a CVE where appropriate) once a patched release is available. We + are happy to credit you for the discovery unless you prefer to remain anonymous. + +Please give us a reasonable amount of time to address the issue before any public +disclosure. + +## Scope + +This policy covers the ZPan codebase in this repository. Vulnerabilities in +third-party dependencies should be reported to the respective upstream projects; +if a dependency issue directly affects ZPan, feel free to let us know so we can +update or mitigate.