Outlines security policy

[brtnfld]

SHINY-45, SHINY-55

Important

Adds a detailed security policy for HDF5, covering scope, reporting, severity assessment, patch management, and researcher recognition.

• Security Scope:
  • Defines in-scope vulnerabilities for HDF5, including memory corruption, RCE, and supply chain issues.
  • Outlines usually in-scope (DoS) and out-of-scope issues (misconfigurations, third-party plugins).
• Supported Versions:
  • Details support matrix and EOL policy, with backporting guidelines.
• Reporting Process:
  • Provides methods for reporting vulnerabilities and required report contents.
• Severity, Triage, and SLAs:
  • Uses CVSS v3.1 for severity assessment, with specific triage and release timelines.
  • Defines severity levels and disclosure deadlines.
• Security Patch Management:
  • Describes announcement, versioning, and emergency release processes.
• Security Expectations & Limitations:
  • Details memory safety, file validation, and plugin security expectations.
• Security Development Practices:
  • Covers build provenance, artifact verification, and testing processes.
• Security Researcher Recognition:
  • Recognizes responsible disclosure and outlines safe harbor policies.

^{This description was created by for a7b28fc. You can customize this summary. It will automatically update as commits are pushed.}

[bmribler]

Is 2.11.x a typo?

[bmribler]

Hmm, I'm confused about 2.10.x...

[bmribler]

Do we want via the forum too?

[bmribler]

extra line?

[bmribler]

Suggestion: "...if the fix is not ready by the 30-day target..." or something like that?

[bmribler]

There is an extra line here but probably intentionally because of the list that follows.