Create AboutCode-level security policy

[mjherzog]

We need to create an AboutCode.org level security policy and reference it on each of our projects.

Some useful resources (GH context) are:

• https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
• https://repos.openssf.org/principles-for-package-repository-security
• https://github.blog/security/vulnerability-research/a-maintainers-guide-to-vulnerability-disclosure-github-tools-to-make-it-simple/

"I’d like to help create an AboutCode-level security policy. Should it live in a central repo or each project?"

[AyanSinhaMahapatra]

@hemantchilkuri thank you for your interest, but this is something which will be handled by the maintainers. If you have any suggestions for improvement though please let us know. Also please find other labeled good first issue from projects at https://github.com/aboutcode-org which are great for contributions.

@mjherzog I've started a draft at https://github.com/aboutcode-org/.github/blob/main/.github/SECURITY.md

[LuciferVid]

Hi @mjherzog, here's a draft SECURITY.md with GitHub Security Advisories as the default disclosure method (no assumptions about a dedicated email).

Would you prefer hosting this centrally (e.g., aboutcode.org/security) and referencing it from other repos, or including the full file in each one?
Happy to proceed based on your preference!

[

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in any AboutCode.org project, we strongly encourage you to report it responsibly.

• Please use the GitHub Security Advisory feature to privately disclose the issue to project maintainers.

We aim to acknowledge and begin investigating all valid reports as soon as possible.

Scope

This policy applies to all projects under the AboutCode GitHub organization, including:

• ScanCode Toolkit
• ScanCode.io
• PurlDB
• DejaCode
• License Expression Toolkit

Disclosure Policy

We follow a responsible disclosure process:

• Confirm and assess the impact of the issue.
• Work privately to develop a fix.
• Coordinate the release of a patch and advisory.
• Credit the reporter (if desired).

Out of Scope

The following are outside the scope of this policy:

• General bug reports or feature requests
• Licensing clarifications or questions
• Vulnerabilities in third-party dependencies not directly exploitable via AboutCode projects

Thank You

We appreciate your efforts to help keep the open source ecosystem secure!

]

[AyanSinhaMahapatra]

@LuciferVid we have started a draft at https://github.com/aboutcode-org/.github/blob/main/.github/SECURITY.md and because this is a github org-specific defaults repo this is now included in all the aboutcode-org repos. See for example: https://github.com/aboutcode-org/scancode-toolkit/?tab=security-ov-file

If you have suggestions to improve and update this, please open a PR and we can review the details there.

[Rohankaf]

Hi @AyanSinhaMahapatra

I would like to work on this task.

Before I begin, I want to confirm a few details to ensure the security policy aligns with AboutCode.org standards and expectations:

1. Should the policy follow a structure similar to GitHub’s SECURITY.md template or would you prefer a more detailed policy (like AboutCode.org’s comprehensive version)?
2. Should the policy include:
   • vulnerability reporting process,
   • supported versions,
   • disclosure timelines,
   • researcher guidelines,
   • contact channels,
   • coordinated disclosure practices?
3. Will this security policy be added to all repositories within the organization (and referenced from each), or should it be created centrally and linked from individual repos?
4. Do you prefer the initial draft as a PR directly, or should I share the outline first for review?

Once I have your guidance, I can prepare a complete and clean SECURITY.md that meets all requirements.

Thanks!

[ChinmayaBiswal7]

@mjherzog

AboutCode.org Security Policy

🛡️ Purpose

AboutCode.org is committed to safe and secure open source software. This security policy describes:

• how to report vulnerabilities
• how we handle security issues
• how we update and protect our codebases

This policy applies to all AboutCode.org projects unless otherwise stated.

---

📬 Reporting a Vulnerability

Please report vulnerabilities privately so we can address them before public disclosure.

Email: security@aboutcode.org
(Use this email exclusively for vulnerability reports and include all necessary technical detail.)

Required fields in your report:

• Package/project name & version
• Detailed description
• Steps to reproduce / PoC
• Impact / severity
• Suggested fix (if available)
• Contact info for follow-up

Upon receiving a report, we will:

1. Acknowledge receipt within 48 hours
2. Validate the report and reproduce the issue
3. Coordinate a fix and advisory timeline

⚠️ Never disclose a vulnerability publicly before the team has had a reasonable chance to assess and fix it.

---

🗂 Severity Classification

We apply a modified CVSS-like scale:

Level	Description	Response
Critical	Remote execution, major data loss	Fix within 7 days
High	Privilege escalation, major component risk	Fix within 30 days
Medium	Low risk impact or hard exploitation	Within next minor release
Low	Minimal or unlikely impact	Monitored

---

🛠 Fixing a Reported Issue

After validating a report:

• We assign a maintainer & timeline
• Communicate status to the reporter
• Prepare coordinated patch and release notes
• When applicable, coordinate with major ecosystem registries

We may request additional info if needed.

---

📢 Coordinated Disclosure

We follow a coordinated disclosure process:

1. Fix committed on private branch
2. Security advisory drafted
3. Advisory published as the patch/release goes public
4. Credit to the reporter, unless they request anonymity

---

🔐 Security Best Practices (Static)

All projects should follow the OSS Security Principles:

• Minimal necessary permissions
• Regular dependencies audit
• Signed releases (where feasible)
• Security testing during CI/CD
• Automated vulnerability scanning

👉 See the OpenSSF Principles for more:
https://repos.openssf.org/principles-for-package-repository-security

---

📎 Tools & Services We Use

We leverage:

• GitHub Security Features
  • Dependabot alerts & updates
  • Security advisories
  • Secret scanning (where available)
  • Code scanning with custom rules

More: https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository

---

📌 Policy Updates

This policy is reviewed annually and updated as needed.

Last review date: YYYY-MM-DD

[shriv-cpu]

Hi, I’d like to work on drafting the AboutCode-level security policy (SECURITY.md) based on GitHub and OpenSSF best practices. Please let me know if that works.

[anish-devgit]

Hey maintainers 👋 I’ve submitted a PR fixing this issue.
Would love your feedback.