docs: make SECURITY-POLICY.md the only disclosure policy - #11242
Open
MarkAtwood wants to merge 4 commits into
Open
docs: make SECURITY-POLICY.md the only disclosure policy#11242MarkAtwood wants to merge 4 commits into
MarkAtwood wants to merge 4 commits into
Conversation
wolfSSL published two disclosure policies that disagreed. The repo named support@wolfssl.com for reports, the website named secure@wolfssl.com, and the report template that gates CVE consideration appeared only in the repo, so a researcher following security.txt never saw it. SECURITY-POLICY.md becomes the whole policy and absorbs what was website-only: products covered, the proof-of-concept requirement, threat-model boundaries, the safe-harbour statement, the PGP fingerprint, and CRA obligations. CRA text corrected. Article 14 requires notification to the coordinator CSIRT and ENISA together through the Article 16 platform, not to ENISA alone. EUVD publication is Article 17(5). Support period is Article 13(8). Article 14 applies from 11 September 2026 and, under Article 69(3), covers products already on the market. SECURITY-POLICY.md and SECURITY-REPORT-TEMPLATE.md are added to EXTRA_DIST. Neither shipped in the release archive.
MarkAtwood
requested review from
danielinux and
dgarske
and
a lite review from Copilot
August 21, 2026 22:57
support@wolfssl.com feeds the Zendesk support queue. Vulnerability reports, including embargoed ones, should not land there. secure@wolfssl.com is the security team address and is the only UID on the published PGP key. Reports go there; support@ is listed as general support only.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR consolidates wolfSSL’s vulnerability disclosure guidance into SECURITY-POLICY.md as the canonical policy, updating GitHub’s SECURITY.md to point to it and adjusting distribution metadata so the relevant documents are packaged.
Changes:
- Expanded
SECURITY-POLICY.mdwith additional scope, evidence requirements, threat-model boundaries, disclosure/safe-harbor language, PGP details, and EU CRA obligations. - Updated
.github/SECURITY.mdto remove the “website is canonical” framing and instead describeSECURITY-POLICY.mdas the full policy. - Added
SECURITY-POLICY.mdandSECURITY-REPORT-TEMPLATE.mdtoEXTRA_DISTinMakefile.am.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
SECURITY-POLICY.md |
Becomes the expanded, canonical vulnerability disclosure policy document. |
Makefile.am |
Packages the security policy and report template into make dist outputs via EXTRA_DIST. |
.github/SECURITY.md |
Points GitHub’s Security tab guidance at SECURITY-POLICY.md as the full policy. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
162
to
+164
| EXTRA_DIST+= .cyignore | ||
| EXTRA_DIST+= SECURITY-POLICY.md | ||
| EXTRA_DIST+= SECURITY-REPORT-TEMPLATE.md |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SECURITY-POLICY.mdbecomes wolfSSL's only vulnerability disclosure policy.The problem
We published two policies that disagreed:
support@wolfssl.com feeds the Zendesk support queue. Embargoed vulnerability reports should not land there. secure@wolfssl.com is the security team address and is the only UID on the published PGP key, which dates to 2015. Reports go to secure@; support@ is listed as general support only.
RFC 9116 discovery goes security.txt → website policy. A researcher following it never saw the template requirement, then missed the CVE bar on a rule they were never shown.
Each document also claimed to be canonical.
Changes
SECURITY-POLICY.mdabsorbs what was website-only: products covered, proof-of-concept requirement, threat-model boundaries, safe harbour, PGP fingerprint, CRA obligations..github/SECURITY.mdpoints at the policy and drops the claim that the website holds a copy of it.Makefile.am:SECURITY-POLICY.mdandSECURITY-REPORT-TEMPLATE.mdadded toEXTRA_DIST. Neither shipped in the release tarball.Reporting addresses now live in two places: this policy and
security.txt. RFC 9116 requires the latter.Website change, deployed separately
/.well-known/vulnerability-disclosure-policy.txtis replaced by a short note stating the policy isSECURITY-POLICY.mdin this repo, and listing what it covers.security.txtkeeps secure@ as its only reportingContact:; its internal authoring comments are stripped and one Encryption URL is corrected towww..Merge this first. The website note points at
SECURITY-POLICY.mdfor the reporting address and threat-model boundaries, which only land here.Review note
@dgarske this reverses the support@ preference from #10559. support@ terminates in Zendesk, so embargoed reports would sit in the general support queue, and a report encrypted to the published key is unreadable there. secure@ is the key's only UID.
The monitoring concern behind your original call stands: Art. 14 starts a 24-hour clock at awareness, so secure@ needs continuous coverage. That belongs in the escalation runbook, not in routing researchers to Zendesk.