security policy does not state a disclosure timeline, a channel for notifying users, or how advisories are published #120

Measured

• SECURITY.md (on main and in 0.3.1) gives two ways to report a vulnerability: a confidential GitHub advisory and an email address (lines 8-11).
• It promises to "acknowledge your report, keep you informed while we investigate, and credit you in the advisory" (lines 17-18) but gives no time for any of those steps and no target for shipping a fix.
• "Only the latest release receives fixes" (lines 20-22) is the whole support statement.
• It does not say how users learn that a release is affected by an actively exploited vulnerability or a severe incident, nor where advisories for fixed vulnerabilities are published.
• The repository has no published security advisory. README.md has no notice area for security information.

Why it matters

The Cyber Resilience Act (Regulation (EU) 2024/2847) requires manufacturers to have a coordinated vulnerability disclosure policy and a contact address for reports (Annex I, Part II(5)-(6)), to publicly disclose fixed vulnerabilities with a description, the affected versions and the fixes (Annex I, Part II(4)), to remediate vulnerabilities without delay (Annex I, Part II(2)) and to inform impacted users of an actively exploited vulnerability or a severe incident and of the corrective measures (Art. 14(8)). The user-facing duty of Art. 14 already applies. Someone who reports a vulnerability, or who runs the CLI in a pipeline, has nothing today that says when to expect an answer or where to look for a security notice.

Acceptance criteria

• SECURITY.md states a disclosure and response timeline: time to acknowledge a report, time to a first assessment, and target times to ship a fix, by severity. It states the coordinated disclosure period and what happens if it is exceeded.
• SECURITY.md says where users are told about an actively exploited vulnerability or a severe incident that affects a release (for example GitHub security advisories, the release notes and a notice at the top of the README), and which of these is updated first.
• SECURITY.md describes how an advisory for a fixed vulnerability is published: description, affected and fixed versions, severity, credit, and a machine-readable form (the GitHub advisory with a CVE or GHSA identifier).
• A template for the advisory text is kept in the repository so every advisory has the same fields.
• README.md links to the security policy and has a place for a short security notice.

Depends on

Nothing. This issue also covers the stated time targets for fixing reported vulnerabilities (Annex I, Part II(2)), so those are not tracked separately.