From 63c8f96dff7635f9bc504842337b528f12a9f779 Mon Sep 17 00:00:00 2001 From: danielpeintner Date: Wed, 8 Jul 2026 11:20:09 +0200 Subject: [PATCH 1/2] Update security reporting instructions in SECURITY.md Use the new Eclipse template from https://github.com/eclipse-csi/security-handbook/blob/main/templates/SECURITY.md Changes I made to the template * Updates the GITHUB ADVISORIES link to https://github.com/eclipse-thingweb/node-wot/security/advisories/new * The template allows removing this possibility. Shall we do that or keep it? * If we keep it, we can no longer copy and paste it everywhere since the link changes * Removed the last part about "versions," which seems neither clear nor necessary to me. * Question: The template talks about "SQL injection" which will hardly happen in our case. Shall we remove it as well? --- SECURITY.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 4da3adf..f812142 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,16 +1,17 @@ # Security Policy + This Eclipse Foundation Project adheres to the [Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/). ## How To Report a Vulnerability If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure. -**Please do not report security vulnerabilities through public issues, discussions, or pull requests.** +**Please do not report security vulnerabilities through public issues, discussions, or change requests.** Instead, report it using one of the following ways: -* Contact the [Eclipse Foundation Security Team](mailto:security@eclipse-foundation.org) via email * Create a [confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/new?issuable_template=new_vulnerability) in the Eclipse Foundation Vulnerability Reporting Tracker +* Report a [vulnerability](https://github.com/eclipse-thingweb/node-wot/security/advisories/new) directly via private vulnerability reporting on GitHub You can find more information about reporting and disclosure at the [Eclipse Foundation Security page](https://www.eclipse.org/security/). From 0843cf339e8f11a6ff2eac89fd0fae01e8a6364f Mon Sep 17 00:00:00 2001 From: danielpeintner Date: Thu, 6 Aug 2026 11:15:28 +0200 Subject: [PATCH 2/2] Delete SECURITY.md because it is different for each repo --- SECURITY.md | 30 ------------------------------ 1 file changed, 30 deletions(-) delete mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index f812142..0000000 --- a/SECURITY.md +++ /dev/null @@ -1,30 +0,0 @@ -# Security Policy - -This Eclipse Foundation Project adheres to the [Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/). - -## How To Report a Vulnerability - -If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure. - -**Please do not report security vulnerabilities through public issues, discussions, or change requests.** - -Instead, report it using one of the following ways: - -* Create a [confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/new?issuable_template=new_vulnerability) in the Eclipse Foundation Vulnerability Reporting Tracker -* Report a [vulnerability](https://github.com/eclipse-thingweb/node-wot/security/advisories/new) directly via private vulnerability reporting on GitHub - -You can find more information about reporting and disclosure at the [Eclipse Foundation Security page](https://www.eclipse.org/security/). - -Please include as much of the information listed below as you can to help us better understand and resolve the issue: - -* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) -* Affected version(s) -* Impact of the issue, including how an attacker might exploit the issue -* Step-by-step instructions to reproduce the issue -* The location of the affected source code (tag/branch/commit or direct URL) -* Full paths of source file(s) related to the manifestation of the issue -* Configuration required to reproduce the issue -* Log files that are related to this issue (if possible) -* Proof-of-concept or exploit code (if possible) - -This information will help us triage your report more quickly.