From 33078a7d353dbad0e861f9ee039712960ad84ef3 Mon Sep 17 00:00:00 2001 From: Long Ngo Date: Fri, 6 Nov 2026 14:01:04 +0700 Subject: [PATCH] Create SECURITY.md --- SECURITY.md | 99 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..755c1cd --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,99 @@ +# Security Policy + +## Supported Versions + +ARTEX is an autonomous penetration-testing tool. Security fixes are provided only for the latest official release line. The `main` branch is not considered a stable release and may change at any time. + +| Version | Supported | +| ------- | ------------------ | +| 0.5.x | :white_check_mark: | +| 0.4.x | :x: | +| < 0.4 | :x: | + +Notes: +- Please upgrade to the latest release before reporting a vulnerability. +- Forks, custom builds from arbitrary commits, and modified versions are not covered by official support. + +## Reporting a Vulnerability + +**Do not open a public issue for a security vulnerability.** + +Preferred channels: +1. Use **GitHub Security Advisories** → **Security** tab → **Report a vulnerability** in the `[owner]/ARTEX` repository. +2. If GitHub Advisories are unavailable, email **security@[your-domain]**. + PGP key: `[link or fingerprint]` + +Please include: +- A description of the vulnerability and its expected impact. +- The ARTEX version and/or commit hash. +- Runtime environment (OS, Docker/local, PostgreSQL, LLM provider, etc.). +- Minimal reproduction steps (PoC). +- Logs, screenshots, or sample traffic with **sensitive data removed**. +- Suggested remediation, if available. + +**Do not send** real third-party data, credentials, tokens, customer data, or unredacted sensitive content. + +## Scope and Authorized Testing + +ARTEX is an offensive-security tool. Test only against: +- Your own ARTEX deployment in a lab or local environment; +- Systems you own; +- Targets explicitly authorized in writing (bug bounty, pentest contract, etc.). + +Testing, scanning, or exploiting third-party systems without explicit authorization is strictly prohibited. Reports that violate this principle may be closed without action. + +## What to Expect + +We aim to respond on a best-effort basis, as an open-source project: + +| Stage | Expected timeframe | +|---|---| +| Acknowledgement of report | within 3 business days | +| Initial triage / severity classification | within 7 business days | +| Progress update | every 7–14 days, or when there is a material change | +| Fix for Critical severity | target 7–14 days | +| Fix for High severity | target 30 days | +| Fix for Medium/Low severity | aligned with release schedule, typically 60–90 days | + +These timelines may change depending on complexity, third-party dependencies, or maintainer capacity. + +## If a Report Is Accepted + +- We will open a private **GitHub Security Advisory** for coordination. +- We will identify the release containing the fix when it is published. +- We may request a **CVE** if the vulnerability qualifies. +- We will credit you or your organization in the advisory if you wish. +- Default disclosure timing: **90 days** after a fix is available, or earlier by mutual agreement. If the vulnerability is being exploited in the wild, we may disclose earlier. + +## If a Report Is Declined + +We will explain the reason, for example: +- It is not a security vulnerability but intended behavior. +- It is outside ARTEX’s scope (e.g., an issue in an LLM provider, PostgreSQL, Docker, or a browser). +- There is insufficient information to reproduce it. +- The report only states that “the tool can be misused” without identifying a specific technical flaw in ARTEX. + +Where appropriate, we may convert the report into a public hardening issue or feature request. + +## Out of Scope + +The following are generally **not** considered ARTEX security vulnerabilities: +- Attacks or scans against systems you do not own or are not authorized to test. +- Self-XSS, spam, or brute-force without real impact. +- Large-scale DoS/DDoS or resource-exhaustion attacks. +- Social engineering targeting maintainers or users. +- Issues that exist only in third-party dependencies and do not affect ARTEX. +- Reports that “ARTEX can be used to attack systems” when the user has valid authorization — this is the nature of a penetration-testing tool, not a vulnerability. +- Missing headers or hardening configuration without a concrete security impact. + +## Safe Harbor + +We welcome ethical security research. If you follow this policy and test only within authorized scope, we will not pursue legal action against you for good-faith research. This does not exempt you from applicable laws in your jurisdiction. + +## Disclosure Policy + +- Do not publicly disclose vulnerability details before a fix is available or before the coordinated disclosure period ends. +- Do not publish a public PoC without maintainer consent. +- If you do not receive a response within a reasonable time, please ping the contact channel above before disclosing. + +Thank you for helping make ARTEX safer.