Add "Flow Rewards" section to Atree Security Policy#620
Conversation
This commit adds a "Flow Rewards" section to SECURITY.md with some text (paraphrased from Jan's ideas) that might reduce security-related noise while still encouraging valid security reports.
The first paragraph under "Flow Rewards" section is moved to the vulnerability disclosure program by Jan, so we don't have to keep that requirement in this document. This commit replaces the specific requirement with the more general statement: "Security reports that follow the guidelines and meet other conditions of the vulnerability disclosure program might qualify for Flow Protocol Rewards."
| - list of affected platforms (Atree is only officially supported on 64-bit architectures) | ||
|
|
||
| - version of [Flow Emulator](https://github.com/onflow/flow-emulator) used to check the reported issue (issue might be prevented by Flow components that set or enforce limits on Atree) | ||
| - list of changes to the source code of Flow components (generally, the vulnerability reproducer shouldn't require modifying Flow source code) |
There was a problem hiding this comment.
To get fewer false positive reports, we might want to change this and require reports not to modify Flow source code, they should be for a currently deployed releases
There was a problem hiding this comment.
To get fewer false positive reports, we might want to change this and require reports not to modify Flow source code, they should be for a currently deployed releases
Great point! I was tempted to do that at first, but I'm concerned about requirements in SECURITY.md getting too strict because reports with real security bugs might not be sent to us.
The PR's compromise is to require reports to list their changes to Flow source code, and also remind that such changes generally shouldn't be made for reproducers (to allow for rare exceptions). And outside this repo, @j1010001 was planning to add the stricter requirements to the vulnerability disclosure program to reduce false alarms in reports that want to qualify for rewards/bounties.
For now, maybe we can see if the milder changes to SECURITY.md combined with stricter changes outside this repo (vulnerability disclosure program) reduces the frequency of false positive reports. If it doesn't work in reducing false positive reports, we can make the requirements stricter as suggested.
Co-authored-by: Bastian Müller <bastian@turbolent.com>
2 participants
This PR adds a "Flow Rewards" section to SECURITY.md with some text paraphrased from some of @j1010001 ideas today, which might reduce security-related noise while still encouraging valid security reports.
Thanks @j1010001! 👍
Caveats
mainbranchFiles changedin the Github PR explorer