derek.holloway
7502bf64a4
CodeQL / Analyze (actions) (push) Canceled after 0s
CodeQL / Analyze (python) (push) Canceled after 0s
pre-commit / pre-commit (push) Canceled after 0s
Multi-Arch CI / setup (push) Canceled after 0s
Publish build_manylinux_x86_64 images / publish_build_manylinux_x86_64 (push) Canceled after 0s
Setup (Multi-Arch) / setup (push) Canceled after 0s
Multi-Arch CI / Linux::${{ fromJSON(needs.setup.outputs.linux_build_config || '{}').build_variant_label || 'skip' }} (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish no_rocm_image_ubi10 image / publish_no_rocm_image_ubi10 (push) Canceled after 0s
Multi-Arch CI / Windows::${{ fromJSON(needs.setup.outputs.windows_build_config || '{}').build_variant_label || 'skip' }} (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Multi-Arch CI / Manifest Diff (push) Canceled after 0s
TheRock Manifest Diff Report / Generate Manifest Diff Report (push) Canceled after 0s
Multi-Arch CI / CI Summary (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04 (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04_ocl_rt images / publish_no_rocm_image_ubuntu24_04_ocl_rt (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_rocgdb (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04_rocgdb images / publish_no_rocm_image_ubuntu24_04_rocgdb (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_ocl_rt (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Unit Tests / Unit Tests :: ubuntu-24.04 (push) Canceled after 0s
Unit Tests / Unit Tests :: windows-2022 (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_media (push) Canceled after 0s
Unit Tests / Unit Tests Summary (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_openmpi (push) Canceled after 0s
67 lines
3.1 KiB
Markdown
67 lines
3.1 KiB
Markdown
# Security Policy
|
|
As an open-source project, we understand the importance of and responsibility
|
|
for security. This Security Policy outlines our guidelines and procedures to
|
|
ensure the highest level of security and trust for oneTBB users.
|
|
|
|
## Supported Versions
|
|
Security vulnerabilities are fixed in the [latest version][1]
|
|
and delivered as a patch release. We don't guarantee security fixes to be
|
|
back-ported to older oneTBB versions.
|
|
|
|
## Report a Vulnerability
|
|
We are very grateful to the security researchers and users that report back
|
|
security vulnerabilities. We investigate every report thoroughly.
|
|
We strongly encourage you to report security vulnerabilities to us privately,
|
|
before disclosing them on public forums or opening a public GitHub* issue.
|
|
|
|
Report a vulnerability to us in one of two ways:
|
|
* Open a draft **[GitHub* Security Advisory][2]**
|
|
* Send an e-mail to: **security@uxlfoundation.org**.
|
|
Along with the report, provide the following info:
|
|
* A descriptive title.
|
|
* Your name and affiliation (if any).
|
|
* A description of the technical details of the vulnerabilities.
|
|
* A minimal example of the vulnerability so we can reproduce your findings.
|
|
* An explanation of who can exploit this vulnerability, and what they gain
|
|
doing so.
|
|
* Whether this vulnerability is public or known to third parties. If it is,
|
|
provide details.
|
|
|
|
### When Should I Report a Vulnerability?
|
|
* You think you discovered a potential security vulnerability in oneTBB.
|
|
* You are unsure how the potential vulnerability affects oneTBB.
|
|
* You think you discovered a vulnerability in another project or 3rd party
|
|
component on which oneTBB depends. If the issue is not fixed in the 3rd party
|
|
component, try to report directly there first.
|
|
|
|
### When Should I NOT Report a Vulnerability?
|
|
* You got an automated scan hit and are unable to provide details.
|
|
* You need help using oneTBB for security.
|
|
* You need help applying security-related updates.
|
|
* Your issue is not security-related.
|
|
|
|
## Security Reports Review Process
|
|
We aim to respond quickly to your inquiry and coordinate a fix and
|
|
disclosure with you. All confirmed security vulnerabilities will be addressed
|
|
according to severity level and impact on oneTBB. Normally, security issues
|
|
are fixed in the next planned release.
|
|
|
|
## Disclosure Policy
|
|
We will publish security advisories using the
|
|
[**GitHub Security Advisories feature**][3]
|
|
to keep our community well-informed, and will credit you for your findings
|
|
unless you prefer to stay anonymous. We request that you refrain from
|
|
exploiting the vulnerability or making it public before the official disclosure.
|
|
|
|
We will disclose the vulnerabilities and bugs as soon as possible once
|
|
mitigation is implemented and available.
|
|
|
|
## Feedback on This Policy
|
|
If you have any suggestions on how this Policy could be improved, submit
|
|
an issue or a pull request to this repository. **Do not** report
|
|
potential vulnerabilities or security flaws via a pull request.
|
|
|
|
[1]: https://github.com/uxlfoundation/oneTBB/releases/latest
|
|
[2]: https://github.com/uxlfoundation/oneTBB/security/advisories/new
|
|
[3]: https://github.com/uxlfoundation/oneTBB/security/advisories
|