From 88b01ef6f033058331e664e8bf9fc86cb38b0de5 Mon Sep 17 00:00:00 2001 From: cpq Date: Wed, 21 Oct 2026 11:48:41 +0100 Subject: [PATCH] Add security.md --- SECURITY.md | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..1af66309 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,41 @@ +# Security Policy + +Mongoose is a full-stack embedded networking library by Cesanta Software Ltd, +. This policy covers how to report vulnerabilities +and how Cesanta handles them. + +## Supported versions + +Security fixes go to the `master` branch and the latest release. + +## Reporting a vulnerability + +Do not report security issues in public GitHub issues. Report them +privately using GitHub Security Advisories: + + +Include the Mongoose version or commit, steps or a proof of concept to reproduce, and +the impact. Cesanta usually responds the same business day. + +## Disclosure process + +1. Cesanta reviews the report and coordinates a fix with the reporter. +2. Eligible commercial customers receive a notification and a private fix + one month before the CVE becomes public. +3. The fix and the CVE are then published. The reporter is credited in the + GitHub Security Advisory. + +## Security testing + +- CI on every push, unit tests built with ASAN and UBSan +- CodeQL static analysis on every commit +- Continuous fuzzing on OSS-Fuzz, plus nightly libFuzzer runs +- AI-assisted security review on every pull request +- Regular review by independent security research groups worldwide + +## EU Cyber Resilience Act (CRA) + +Mongoose supports CRA compliance for connected products: a documented +vulnerability handling process (this file), TLS 1.3, signed OTA firmware +updates, and an SBOM (`sbom.cdx.json`). Details: +