From b311306ba5e55ccbdb2f0bd3d388a92c0f4377ea Mon Sep 17 00:00:00 2001 From: Bart Louwers Date: Mon, 14 Aug 2023 17:27:58 +0200 Subject: [PATCH] Update SECURITY.md (#1519) --- SECURITY.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 83b6a19c8..7193b7a35 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,8 +1,20 @@ # Security Policy -To report a vulnerability in MapLibre Native, create a [security advisory](https://github.com/maplibre/maplibre-native/security/advisories/new). -You will be able to privately discuss the issue with the maintainers of MapLibre Native and we can collaborate on a fix. +## Reporting vulnerabilities + +To report a vulnerability in MapLibre Native, create a [security advisory](https://github.com/maplibre/maplibre-native/security/advisories/new). You will be able to privately discuss the issue with the maintainers of MapLibre Native and we can collaborate on a fix. We highly appreciate your reports, but we do not pay out bug bounties at this time. We will acknowledge your report in our newsletter with your consent. + +## Mitigation + +We are actively trying to prevent security incidents using the following methods: + +- Static analysis with the use of [clang-tidy](https://clang.llvm.org/extra/clang-tidy/). +- C++ [code scanning](https://github.com/maplibre/maplibre-native/security/code-scanning) with CodeQL. + +MapLibre Native relies on several [external open-source libraries](https://github.com/maplibre/maplibre-native/issues/990). We currently do not monitor these dependencies automatically for vulnerabilities. + +If you have any suggestions how to improve our security mitigation strategies, feel free to open an issue or start a Discussion. Be sure to check out the [open issues](https://github.com/maplibre/maplibre-native/labels/security) tagged with the security label.