From c2923b4d61c32a07b6f050badf256ee031ba5214 Mon Sep 17 00:00:00 2001 From: Artem Gavrilov Date: Fri, 19 Apr 2024 14:48:48 +0200 Subject: [PATCH] Create SECURITY.md (#452) * Create SECURITY.md * Update supported versions section --- SECURITY.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..18305d2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,24 @@ +# Security Policy + +## Supported Versions + +pg_stat_monitor project follows rolling release strategy. So all security updates go to new versions. + +## Reporting a Vulnerability + +Please report any vulnerabilities to our project in [Jira](https://perconadev.atlassian.net/jira/software/c/projects/PG/issues). + +If the vulnerability is accepted and confirmed by our experts, you should normally expect us to deliver +a version with a fix according to the timelines provided below: + +For Percona created software (our engineers wrote the code): + +- Low/Medium: 120 days +- High: 90 days +- Critical: ASAP but should not exceed 30 days + +For Non-Percona created software (upstream provided/packaged) from the time the vendor releases a patch: + +- Low/Medium: 2nd release from current version +- High: Next release +- Critical: Hotfix or no later than next release (our regular release cadence is once every month)