blob: e0086a4e3c92d3c9033dc3250f17bb25e72800bf (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
# Security Policy
## Reporting a Vulnerability
We're extremely grateful for security researchers and users who report vulnerabilities they discovered in YDB. All reports are thoroughly investigated.
To report a potential vulnerability in YDB please email details to [security@ydb.tech](mailto:security@ydb.tech).
### When Should I Report a Vulnerability?
- You think you discovered a potential security vulnerability in YDB
- You are unsure how a vulnerability affects YDB
## Security Vulnerability Response
Each report is acknowledged and analyzed by YDB maintainers within 5 working days.
We will keep the reporter informed about the issue progress.
## Public Disclosure Timing
A public disclosure date is negotiated by YDB maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a mitigation is available for YDB users. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days.
|
