From f2eeedeeade7956834b8d4bf5c64826d37093719 Mon Sep 17 00:00:00 2001 From: Zoi Kaoudi Date: Tue, 1 Sep 2026 13:24:40 +0200 Subject: [PATCH 1/2] Copy security doc to code repo Updated security guidelines regarding the Wayang JSON REST API --- SECURITY.md | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..99ff2d8cb --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,41 @@ +# Wayang Security + +The Apache Software Foundation (ASF) and the Apache Wayang community take security very seriously. +Apache Wayang specifically provides robust security features and actively addresses concerns around potential vulnerabilities. +If you have discovered a vulnerability or have concerns regarding Apache Wayang security, please immediately contact the security team via email at +[security@wayang.apache.org](mailto:security@wayang.apache.org). + +In your email, please include: +- A detailed description of the security issue +- Steps to reproduce the vulnerability, if possible + +Upon receiving your report, our security team will review the provided information and respond accordingly. + +Please reserve the security address exclusively for reporting undisclosed vulnerabilities. For general security-related questions, usage of security features, or addressing known fixed issues, please utilize our user and developer mailing lists instead. Do not publicly disclose vulnerabilities without first reporting them to the Apache Wayang security team. + +The ASF Security team maintains detailed guidelines on managing and addressing vulnerabilities. For further information, please refer to the [ASF Security Page](https://www.apache.org/security/). + +## Advisories for Dependencies + +Many organizations employ security scanning tools to identify components with known security advisories. Although we strongly recommend these tools as they can alert users to potential risks, they often generate false positives. This occurs because a vulnerable dependency may not necessarily impact Apache Wayang if used in a non-exploitable manner. + +Therefore, advisories regarding Apache Wayang's dependencies are not automatically considered critical. However, if additional analysis indicates that Apache Wayang might be affected by a dependency's vulnerability, please report your findings privately to [security@wayang.apache.org](mailto:security@wayang.apache.org). + +If a dependency advisory is identified, please: + +1. Verify if our DependencyCheck suppressions contain relevant details. +2. Check our issue tracker for discussions regarding this advisory. +3. Conduct your own analysis to determine whether Apache Wayang is affected. + - If affected, report your findings privately through [security@wayang.apache.org](mailto:security@wayang.apache.org). + - If not affected, please contribute by updating the DependencyCheck suppression list, clearly documenting why Apache Wayang is not impacted. + +## Component-Specific Security Notes + +### Wayang JSON REST API + +The `wayang-api-json` module exposes a REST endpoint that accepts a WayangPlan in JSON format, including UDFs to be executed by the targeted engine. **This endpoint has no built-in authentication or authorization** — any client that can reach it can submit UDFs that will execute with the privileges of the Wayang process. + +This is a deliberate scope decision: the module is intended for use on a trusted network only (localhost, a private subnet, or behind a VPN). +**If the endpoint is exposed on a public IP, an authentication and encryption layer is recommended**. + +Questions on this are welcome at [security@wayang.apache.org](mailto:security@wayang.apache.org). From d4dd812a39a69b22533040a04e6b36d2c019ab7e Mon Sep 17 00:00:00 2001 From: Zoi Kaoudi Date: Thu, 3 Sep 2026 21:07:09 +0200 Subject: [PATCH 2/2] Update SECURITY.md with license Added licensing information --- SECURITY.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 99ff2d8cb..d62b1e83e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,21 @@ + # Wayang Security The Apache Software Foundation (ASF) and the Apache Wayang community take security very seriously.