|
| 1 | +<!-- |
| 2 | +SPDX-FileCopyrightText: 2024 Constributors to the oneapi-spec project |
| 3 | +
|
| 4 | +SPDX-License-Identifier: CC-BY-4.0 |
| 5 | +--> |
| 6 | + |
| 7 | +# Security Policy |
| 8 | +As an open-source project, we understand the importance of and responsibility |
| 9 | +for security. This Security policy outlines our guidelines and procedures for |
| 10 | +ensuring the highest level of Security and trust for our users. |
| 11 | + |
| 12 | +## Supported Versions |
| 13 | +We regularly perform patch releases for the supported |
| 14 | +[latest version][1], |
| 15 | +which contain fixes for security vulnerabilities and important bugs. Prior |
| 16 | +releases might receive critical security fixes on a best-effort basis; however, |
| 17 | +we cannot guarantee that security fixes will get back-ported to these |
| 18 | +unsupported versions. |
| 19 | + |
| 20 | +## Report a Vulnerability |
| 21 | +We are very grateful to the security researchers and users that report back |
| 22 | +security vulnerabilities. We investigate every report thoroughly. |
| 23 | +We strongly encourage you to report security vulnerabilities to us privately, |
| 24 | +before disclosing them on public forums or opening a public GitHub issue. |
| 25 | +Report a vulnerability to us in one of two ways: |
| 26 | +* Open a draft [**GitHub Security Advisory**][2] |
| 27 | +* Send e-mail to the following address: **[email protected]**. |
| 28 | +Along with the report, please include the following info: |
| 29 | + * A descriptive title. |
| 30 | + * Your name and affiliation (if any). |
| 31 | + * A description of the technical details of the vulnerabilities. |
| 32 | + * A minimal example of the vulnerability so we can reproduce your findings. |
| 33 | + * An explanation of who can exploit this vulnerability, and what they gain |
| 34 | + when doing so. |
| 35 | + * Whether this vulnerability is public or known to third parties. If it is, |
| 36 | + please provide details. |
| 37 | + |
| 38 | +### When Should I Report a Vulnerability? |
| 39 | +* You think you discovered a potential security vulnerability in oneDNN. |
| 40 | +* You are unsure how the potential vulnerability affects oneDNN. |
| 41 | +* You think you discovered a vulnerability in another project or 3rd party |
| 42 | +component on which oneDNN depends. If the issue is not fixed in the 3rd party |
| 43 | +component, try to report directly there first. |
| 44 | + |
| 45 | +### When Should I NOT Report a Vulnerability? |
| 46 | +* You got an automated scan hit and are unable to provide details. |
| 47 | +* You need help using oneDNN for security. |
| 48 | +* You need help applying security-related updates. |
| 49 | +* Your issue is not security-related. |
| 50 | + |
| 51 | +## Security Reports Review Process |
| 52 | +Our goal is to respond quickly to your inquiry, and to coordinate a fix and |
| 53 | +disclosure with you. All confirmed security vulnerabilities will be addressed |
| 54 | +according to severity level and impact on oneDNN. Normally, security issues |
| 55 | +are fixed in the next planned release. |
| 56 | + |
| 57 | +## Disclosure Policy |
| 58 | +We will publish security advisories using the |
| 59 | +[**GitHub Security Advisories feature**][3] |
| 60 | +to keep our community well-informed, and will credit you for your findings |
| 61 | +unless you prefer to stay anonymous. We request that you refrain from |
| 62 | +exploiting the vulnerability or making it public before the official disclosure. |
| 63 | + |
| 64 | +We will disclose the vulnerabilities and/or bugs as soon as possible once |
| 65 | +mitigation is implemented and available. |
| 66 | + |
| 67 | +## Feedback on This Policy |
| 68 | +If you have any suggestions on how this Policy could be improved, please submit |
| 69 | +an issue or a pull request to this repository. Please **do not** report |
| 70 | +potential vulnerabilities or security flaws via a pull request. |
| 71 | + |
| 72 | +[1]: https://github.com/oneapi-src/oneapi-spec/releases/latest |
| 73 | +[2]: https://github.com/oneapi-src/oneapi-spec/security/advisories/new |
| 74 | +[3]: https://github.com/oneapi-src/oneapi-spec/security/advisories |
0 commit comments