|
1 | | -# Coordinated Vulnerability Disclosure Policy |
| 1 | +# Security Policy |
2 | 2 |
|
3 | | -The Cosmos ecosystem believes that strong security is a blend of highly |
4 | | -technical security researchers who care about security and the forward |
5 | | -progression of the ecosystem and the attentiveness and openness of Cosmos core |
6 | | -contributors to help continually secure our operations. |
| 3 | +The security of Story is critical. If you discover any security vulnerabilities, we appreciate your help in responsibly disclosing them to us. |
7 | 4 |
|
8 | | -> **IMPORTANT**: *DO NOT* open public issues on this repository for security |
9 | | -> vulnerabilities. |
| 5 | +## Reporting a Vulnerability |
10 | 6 |
|
11 | | -## Scope |
| 7 | +**Please do not file a public ticket** mentioning the vulnerability. |
12 | 8 |
|
13 | | -| Scope | |
14 | | -|-----------------------| |
15 | | -| last release (tagged) | |
16 | | -| main branch | |
| 9 | +We are in the process of setting up a bug bounty program. This document will be updated when ready, and the program will be announced on our channels. |
17 | 10 |
|
18 | | -The latest **release tag** of this repository is supported for security updates |
19 | | -as well as the **main** branch. Security vulnerabilities should be reported if |
20 | | -the vulnerability can be reproduced on either one of those. |
| 11 | +We recommend to wait for the program to be ready for reporting, but if you find a vulnerability that will put the network at risk, please send an email to **[email protected]**. We kindly request that you provide us with the following details: |
21 | 12 |
|
22 | | -## Reporting a Vulnerability |
| 13 | +- A clear description of the vulnerability and its potential impact. |
| 14 | +- Steps to reproduce the vulnerability. |
| 15 | +- Any additional information or proof of concept that can help us understand and address the issue. |
| 16 | + |
| 17 | +If applicable, rewards will be provided through the bug bounty program when ready. |
| 18 | + |
| 19 | +## Audit Reports, Known Issues and Ongoing Auditing Contest |
| 20 | + |
| 21 | +There is a series of known issues reported by our our multiple auditors. Please [review our audit reports](./audits/) to make sure you are not reporting a duplicate. |
| 22 | + |
| 23 | +Folders: |
| 24 | + |
| 25 | +- geth: audits of the original geth codebase |
| 26 | +- story: Story network audits (scope includes Story Geth, Story Consensus Client and Cosmos fork, please refer to the relevant issues for this repository) |
| 27 | + |
| 28 | +Story has undergone a public [audit competition by Cantina](https://cantina.xyz/competitions/0561defa-eeb2-4a74-8884-5d7a873afa58). We will publish the report as soon as the judging period is over. |
| 29 | +Please be advised that there is a high chance that your reported vulnerability can be a duplicate if you do it before we publish the report. |
| 30 | + |
| 31 | +## Responsible Disclosure |
| 32 | + |
| 33 | +We believe in responsible disclosure and request that you refrain from publicly disclosing any vulnerabilities until we have had sufficient time to investigate and address them. We appreciate your cooperation in helping us maintain the security and integrity of our blockchain network. |
| 34 | + |
| 35 | +## Disclaimer |
23 | 36 |
|
24 | | -| Reporting methods | |
25 | | -|---------------------------------------------------------------| |
26 | | -| [GitHub Private Vulnerability Reporting][gh-private-advisory] | |
27 | | -| [HackerOne bug bounty program][h1] | |
28 | | - |
29 | | -All security vulnerabilities can be reported under GitHub's [Private |
30 | | -vulnerability reporting][gh-private-advisory] system. This will open a private |
31 | | -issue for the developers. Try to fill in as much of the questions as possible. |
32 | | -If you are not familiar with the CVSS system for assessing vulnerabilities, just |
33 | | -use the Low/High/Critical severity ratings. A partially filled in report for a |
34 | | -critical vulnerability is still better than no report at all. |
35 | | - |
36 | | -Vulnerabilities associated with the **Go, Rust or Protobuf code** of the |
37 | | -repository may be eligible for a [bug bounty][h1]. Please see the bug bounty |
38 | | -page for more details on submissions and rewards. If you think the vulnerability |
39 | | -is eligible for a payout, **report on HackerOne first**. |
40 | | - |
41 | | -Vulnerabilities in services and their source codes (JavaScript, web page, Google |
42 | | -Workspace) are not in scope for the bug bounty program, but they are welcome to |
43 | | -be reported in GitHub. |
44 | | - |
45 | | -### Guidelines |
46 | | - |
47 | | -We require that all researchers: |
48 | | - |
49 | | -* Abide by this policy to disclose vulnerabilities, and avoid posting |
50 | | - vulnerability information in public places, including GitHub, Discord, |
51 | | - Telegram, and Twitter. |
52 | | -* Make every effort to avoid privacy violations, degradation of user experience, |
53 | | - disruption to production systems (including but not limited to the Cosmos |
54 | | - Hub), and destruction of data. |
55 | | -* Keep any information about vulnerabilities that you’ve discovered confidential |
56 | | - between yourself and the Cosmos engineering team until the issue has been |
57 | | - resolved and disclosed. |
58 | | -* Avoid posting personally identifiable information, privately or publicly. |
59 | | - |
60 | | -If you follow these guidelines when reporting an issue to us, we commit to: |
61 | | - |
62 | | -* Not pursue or support any legal action related to your research on this |
63 | | - vulnerability |
64 | | -* Work with you to understand, resolve and ultimately disclose the issue in a |
65 | | - timely fashion |
66 | | - |
67 | | -### More information |
68 | | - |
69 | | -* See [TIMELINE.md] for an example timeline of a disclosure. |
70 | | -* See [DISCLOSURE.md] to see more into the inner workings of the disclosure |
71 | | - process. |
72 | | -* See [EXAMPLES.md] for some of the examples that we are interested in for the |
73 | | - bug bounty program. |
74 | | - |
75 | | -[gh-private-advisory]: /../../security/advisories/new |
76 | | -[h1]: https://hackerone.com/cosmos |
77 | | -[TIMELINE.md]: https://github.com/cosmos/security/blob/main/TIMELINE.md |
78 | | -[DISCLOSURE.md]: https://github.com/cosmos/security/blob/main/DISCLOSURE.md |
79 | | -[EXAMPLES.md]: https://github.com/cosmos/security/blob/main/EXAMPLES.md |
| 37 | +Please note that this document is subject to change and may be updated as our security practices evolve. We encourage you to check back regularly for any updates or changes. |
0 commit comments