169 lines
5.1 KiB
Markdown
169 lines
5.1 KiB
Markdown
# Responsible Disclosure
|
|
|
|
We take the security of Core PHP Framework seriously. If you believe you have found a security vulnerability, we encourage you to let us know right away.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Email:** support@host.uk.com
|
|
|
|
**PGP Key:** Available on request
|
|
|
|
Please include the following information in your report:
|
|
|
|
- Type of vulnerability
|
|
- Full paths of source file(s) related to the vulnerability
|
|
- Location of the affected source code (tag/branch/commit or direct URL)
|
|
- Step-by-step instructions to reproduce the issue
|
|
- Proof-of-concept or exploit code (if possible)
|
|
- Impact of the issue, including how an attacker might exploit it
|
|
|
|
## What to Expect
|
|
|
|
1. **Acknowledgment** - We will acknowledge receipt of your vulnerability report within 24 hours
|
|
|
|
2. **Investigation** - We will investigate and validate the vulnerability
|
|
|
|
3. **Response Timeline** - Based on severity:
|
|
- **Critical**: 24-48 hours for initial response, patch within 7 days
|
|
- **High**: 48-72 hours for initial response, patch within 14 days
|
|
- **Medium**: 7 days for initial response, patch within 30 days
|
|
- **Low**: 14 days for initial response, patch within 60 days
|
|
|
|
4. **Fix Development** - We will develop a fix and notify you when it's ready for testing
|
|
|
|
5. **Disclosure** - We will coordinate disclosure timing with you
|
|
|
|
## Our Commitment
|
|
|
|
- We will respond to your report promptly
|
|
- We will keep you informed of our progress
|
|
- We will credit you in our security advisory (unless you prefer to remain anonymous)
|
|
- We will not take legal action against you for responsible disclosure
|
|
|
|
## What We Ask
|
|
|
|
- Give us reasonable time to respond before disclosing the vulnerability publicly
|
|
- Make a good faith effort to avoid privacy violations, data destruction, and service interruption
|
|
- Don't access or modify data that doesn't belong to you
|
|
- Don't perform actions that could negatively affect our users
|
|
|
|
## Out of Scope
|
|
|
|
The following are **out of scope**:
|
|
|
|
- Clickjacking on pages with no sensitive actions
|
|
- Unauthenticated/logout CSRF
|
|
- Attacks requiring physical access to a user's device
|
|
- Social engineering attacks
|
|
- Attacks involving physical access to servers
|
|
- Denial of Service attacks
|
|
- Spam or social engineering techniques
|
|
- Reports from automated tools or scanners without validation
|
|
|
|
## Severity Classification
|
|
|
|
### Critical
|
|
|
|
- Remote code execution
|
|
- SQL injection
|
|
- Authentication bypass
|
|
- Privilege escalation to admin
|
|
- Exposure of sensitive data (credentials, keys)
|
|
|
|
### High
|
|
|
|
- Cross-site scripting (XSS) on sensitive pages
|
|
- Cross-site request forgery (CSRF) on sensitive actions
|
|
- Server-side request forgery (SSRF)
|
|
- Insecure direct object references to sensitive data
|
|
- Path traversal
|
|
- XML external entity (XXE) attacks
|
|
|
|
### Medium
|
|
|
|
- XSS on non-sensitive pages
|
|
- Missing security headers
|
|
- Information disclosure (non-sensitive)
|
|
- Open redirects
|
|
|
|
### Low
|
|
|
|
- Missing rate limiting on non-critical endpoints
|
|
- Verbose error messages
|
|
- Best practice violations without direct security impact
|
|
|
|
## Recognition
|
|
|
|
We maintain a Hall of Fame for security researchers who have responsibly disclosed vulnerabilities:
|
|
|
|
**2026**
|
|
- TBD
|
|
|
|
If you would like to be listed, please let us know in your disclosure email.
|
|
|
|
## Legal
|
|
|
|
This disclosure policy is based on industry best practices. By participating in our responsible disclosure program, you agree to:
|
|
|
|
- Comply with all applicable laws
|
|
- Not access or modify data beyond what is necessary to demonstrate the vulnerability
|
|
- Not perform actions that degrade our services
|
|
- Keep vulnerability details confidential until we have released a fix
|
|
|
|
We commit to not pursuing legal action against researchers who:
|
|
|
|
- Follow this policy
|
|
- Act in good faith
|
|
- Don't violate any other laws or agreements
|
|
|
|
## Example Report
|
|
|
|
```
|
|
Subject: [SECURITY] SQL Injection in PostController
|
|
|
|
Vulnerability Type: SQL Injection
|
|
Severity: High
|
|
Affected Component: Mod/Blog/Controllers/PostController.php
|
|
|
|
Description:
|
|
The search functionality in PostController does not properly sanitize
|
|
user input before constructing SQL queries, allowing SQL injection.
|
|
|
|
Steps to Reproduce:
|
|
1. Navigate to /blog/search
|
|
2. Enter payload: ' OR '1'='1
|
|
3. Observe database data exposure
|
|
|
|
Impact:
|
|
Attacker can read arbitrary data from the database, including user
|
|
credentials and API keys.
|
|
|
|
Proof of Concept:
|
|
[Include curl command or video demonstration]
|
|
|
|
Suggested Fix:
|
|
Use parameterized queries or Eloquent ORM instead of raw SQL.
|
|
|
|
Contact:
|
|
[Your name/handle]
|
|
[Your email]
|
|
[Your PGP key if applicable]
|
|
```
|
|
|
|
## Updates to This Policy
|
|
|
|
We may update this policy from time to time. The latest version will always be available at:
|
|
|
|
https://docs.core-php.dev/security/responsible-disclosure
|
|
|
|
## Contact
|
|
|
|
For security issues: support@host.uk.com
|
|
|
|
For general inquiries: https://github.com/host-uk/core-php/issues
|
|
|
|
## References
|
|
|
|
- [OWASP Vulnerability Disclosure Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html)
|
|
- [ISO/IEC 29147:2018](https://www.iso.org/standard/72311.html) - Vulnerability disclosure
|
|
- [ISO/IEC 30111:2019](https://www.iso.org/standard/69725.html) - Vulnerability handling processes
|