Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add back link to the ASF blog about severity to the policy #33691

Merged
merged 2 commits into from
Aug 24, 2023
Merged

Add back link to the ASF blog about severity to the policy #33691

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9925ff5
Add back link to the ASF blog about severity to the policy
potiuk Aug 24, 2023
a4880e5
Update .github/SECURITY.md
potiuk Aug 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,11 +54,16 @@ movie, HTML, or PDF attachment when you could as easily describe it with plain t
Before reporting vulnerabilities, please make sure to read and understand the
[security model](https://airflow.apache.org/docs/apache-airflow/stable/security/security_model.html) of Airflow, because
some of the potential security vulnerabilities that are valid for projects that are publicly accessible
from the Internet, are not valid for Airflow. Airflow is not designed to be used by untrusted users, and some
trusted users are trusted enough to do a variety of operations that could be considered as vulnerabilities
in other products/circumstances. Therefore, some potential security vulnerabilities do not
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
from the Internet, are not valid for Airflow.


Airflow is not designed to be used by untrusted users, and some trusted users are trusted enough to do a
variety of operations that could be considered as vulnerabilities in other products/circumstances.
Therefore, some potential security vulnerabilities do not apply to Airflow, or have a different severity
than some generic scoring systems (for example `CVSS`) calculation suggests. Severity of the issue is
determined based on the criteria described in the
[Severity Rating blog post](https://security.apache.org/blog/severityrating/) by the Apache Software
Foundation Security team.

The [Airflow Security Team](https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst#security-team) will get back to you after assessing the report.

Expand Down