From 48eca064bf6e8270254adfb0ad641b9b21dd5388 Mon Sep 17 00:00:00 2001 From: Elliott Sales de Andrade Date: Mon, 21 Sep 2020 17:10:54 -0400 Subject: [PATCH 1/2] Create security policy --- SECURITY.md | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000000..ced456a1f29a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,31 @@ +# Security Policy + +## Supported Versions + +The following table lists versions and whether they are supported. Security +vulnerability reports will be accepted and acted upon for all supported +versions. + +| Version | Supported | +| ------- | ------------------ | +| 3.3.x | :white_check_mark: | +| 3.2.x | :white_check_mark: | +| 3.1.x | :x: | +| 3.0.x | :x: | +| 2.2.x | :white_check_mark: | +| < 2.2 | :x: | + +## Reporting a Vulnerability + +If you have found a security vulnerability, in order to keep it confidential, +please do not report an issue on GitHub. + +Please email us details of the vulnerability at matplotlib@numfocus.org; +include a description and proof-of-concept that is [short and +self-contained](http://www.sscce.org/). + +You should expect a response within a week of your email. Depending on the +severity of the issue, this may require some time to draft an immediate bugfix +release. Less severe issues may be held until the next release. + +We do not award bounties for security vulnerabilities. From 8733b9b81929f14a51a5c31a6ac2e6f8501eadd1 Mon Sep 17 00:00:00 2001 From: Elliott Sales de Andrade Date: Mon, 21 Sep 2020 17:33:45 -0400 Subject: [PATCH 2/2] Add security policy info to release guide. --- doc/devel/release_guide.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/devel/release_guide.rst b/doc/devel/release_guide.rst index 399c2eb41be2..ea29f74ff69c 100644 --- a/doc/devel/release_guide.rst +++ b/doc/devel/release_guide.rst @@ -96,6 +96,13 @@ Merge ``*-doc`` branch Merge the most recent 'doc' branch (e.g., ``v3.2.0-doc``) into the branch you are going to tag on and delete the doc branch on GitHub. +Update supported versions in Security Policy +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +When making major or minor releases, update the supported versions in the +Security Policy in :file:`SECURITY.md`. Commonly, this may be one or two +previous minor releases, but is dependent on release managers. + Update "What's New" and "API changes" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^