From c198f052ae178effe24888c9a7cee5e075e487c8 Mon Sep 17 00:00:00 2001 From: maurges Date: Mon, 1 Jun 2026 15:37:17 +0200 Subject: [PATCH 1/3] Add security.md Signed-off-by: maurges --- SECURITY.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..dfa8cd5 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,20 @@ +# Security Policy + +## Supported Versions + +Only the latest version of the library is supported. + +## Reporting a Vulnerability + +We ask to report any security vulnerabilities or flaws through: + +1. Github, in the "Security" tab, using the "Report a vulnerability" button. +2. Email, security@dfns.co + +After receiving the report, it will take us up to 2 working days to respond. +We will evaluate the reported vulnerability, determine whether it needs to +be addressed, and (if so) and provide an estimated timeline for addressing it. + +After vulnerability was fixed and the new version of the library was +properly tested, we publish the fix, and publicly disclose the vulnerability +(credits for finding the issue go to the reporter). From 3d330fcfbf1c567e2add1370097fc39121acb340 Mon Sep 17 00:00:00 2001 From: maurges Date: Mon, 1 Jun 2026 15:55:50 +0200 Subject: [PATCH 2/3] Drop the cron from codeql Signed-off-by: maurges --- .github/workflows/codeql.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1899a4f..4cf40da 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -5,8 +5,6 @@ on: branches: [ "m" ] pull_request: branches: [ "m" ] - schedule: - - cron: '32 4 * * 2' permissions: read-all From 98b4959554ae9be497e2825e59d497434dae80cb Mon Sep 17 00:00:00 2001 From: maurges Date: Mon, 1 Jun 2026 16:26:12 +0200 Subject: [PATCH 3/3] Fix empty permissions in workflow Signed-off-by: maurges --- .github/workflows/publish.yml | 3 +++ .github/workflows/rust.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e4c978c..c2c6181 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -6,6 +6,9 @@ on: name: Publish +permissions: + contents: read + env: CARGO_TERM_COLOR: always CARGO_NET_GIT_FETCH_WITH_CLI: true diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 7eb347e..a38cfc2 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,5 +1,8 @@ name: Rust +permissions: + contents: read + on: pull_request: branches: [ "*" ]