Disclosure Policy

After the security email(security@islandora.ca) is received and is assigned to ISRT.

This team will coordinate the fix and release process. The problem is confirmed and a list of all affected versions is determined. Code is audited to find any potential similar problems. Fixes are prepared for all releases which are still under maintenance. These fixes are not committed to the public repository but rather held locally pending the announcement.

A suggested embargo date for this vulnerability is chosen, typically within two business days. However, this may vary depending on the severity of the bug or difficulty in applying a fix. The changes are pushed to the public repository. Announcement will be posted in the Google Groups thread.

This process can take some time, especially when coordination is required with maintainers of other projects. Every effort will be made to handle the bug in as timely a manner as possible, however, it’s important that we follow the release process above to ensure that the disclosure is handled in a consistent manner.

Because of the nature of the risk, avoid discussing security vulnerabilities publicly. Please email security@islandora.ca to open a channel to discuss an issue further.

Security notifications will be distributed via the following methods.

https://groups.google.com/group/islandora
http://islandora.ca/news

Comments on this Policy

If you have suggestions on how this process could be improved please submit a pull request or email security@islandora.ca to discuss.