Policy
Security Policy
Purpose
Secure Development
- Security risks must be considered during design and development.
- Projects must use appropriate validation, error handling, and access controls.
- Security boundaries must be clearly defined and enforced.
- Sensitive information, including credentials and cryptographic keys, must be protected from unauthorized access.
- Security-relevant changes must be reviewed and tested before release.
- Projects should minimize unnecessary functionality and privileges that could increase the attack surface.
Dependencies and Supply-Chain Security
- Dependencies must be necessary for the project's intended functionality.
- Dependencies must be reviewed for security risks, licensing, maintenance status, and suitability.
- Known vulnerabilities in dependencies must be assessed and addressed appropriately.
- Projects should avoid unnecessary dependencies and prefer simpler implementations where practical.
- Build and release processes must be designed to reduce the risk of unauthorized modifications or compromised artifacts.
- Projects must not incorporate dependencies known to introduce unacceptable security risks.
Access Control and Permissions
- Access must be limited to the permissions required for intended functionality.
- Privileged operations must be restricted and explicitly controlled where appropriate.
- Applications must not assume that input, files, network responses, or other external resources are trustworthy.
- Security boundaries must not rely solely on application-level assumptions when stronger enforcement is available.
- Projects should use secure defaults and avoid granting unnecessary permissions.
Vulnerability Reporting and Disclosure
Security vulnerabilities must be reported privately through the channels documented on the official OTF Security page: https://opentechf.org/security(opens in new tab)
Vulnerability Assessment and Remediation
- Security issues must be investigated and prioritized appropriately.
- Projects must take corrective action for confirmed vulnerabilities.
- Fixes must be tested to verify that they address the underlying issue.
- Where necessary, OTF may recommend mitigations or workarounds while a complete fix is being prepared.
- Security fixes must be communicated to affected users when appropriate.
- Related code and design must be reviewed to identify similar vulnerabilities.
Releases and Updates
- Releases must be performed by humans; automated release publication is not permitted.
- Security fixes must receive appropriate review and testing before release.
- Release notes and changelogs must accurately describe security-relevant changes, subject to responsible disclosure considerations.
- Published artifacts must correspond to the intended source and release.
- Projects should provide users with clear instructions for obtaining and applying security updates.
- Known, unresolved security risks must be considered when determining whether a release is suitable for publication.
Security Maintenance
- Relevant security advisories and dependency vulnerabilities must be monitored.
- Security issues must be addressed within a timeframe appropriate to their severity.
- Projects should document support status and communicate when security maintenance ends.
- Unsupported projects must not be represented as receiving ongoing security maintenance.
- Significant changes to a project's threat model or security boundaries must receive appropriate review.