diff mbox series

[yocto-patches,meta-zephyr,master,wrynose] meta-zephyr: Add SECURITY.md file

Message ID 20260908173105.3926377-1-sandeep.gundlupet-raju@amd.com
State New
Headers show
Series [yocto-patches,meta-zephyr,master,wrynose] meta-zephyr: Add SECURITY.md file | expand

Commit Message

Sandeep Gundlupet Raju Sept. 8, 2026, 5:31 p.m. UTC 
To be compliant with the recent yocto project security
processes, add a SECURITY.md for this layer.

The file describes how to report public and embargoed security
vulnerabilities, and points to Yocto stable/LTS and release
maintenance information.

Signed-off-by: Sandeep Gundlupet Raju <sandeep.gundlupet-raju@amd.com>
---
 SECURITY.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 SECURITY.md
diff mbox series

Patch

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..320263c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,22 @@ 
+# How to Report a Potential Vulnerability
+
+If you would like to report a public issue (for example, one with a released
+CVE number), please report it using the mailing list as described in README.md
+If you have a patch ready, submit it following the same procedure as any other
+patch as described in the same file.
+
+If you are dealing with a not-yet released or urgent issue, please send a
+message to the layer maintainers, including as many details as possible:
+  - the layer or software module affected
+  - the recipe and its version
+  - any example code, if available
+
+## Branches maintained with security fixes
+
+See [https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS Stable release and LTS]
+for detailed info regarding the policies and maintenance of Stable branches.
+
+The [https://wiki.yoctoproject.org/wiki/Releases Release page] contains a list of all
+releases of the Yocto Project. Versions in grey are no longer actively maintained with
+security patches, but well-tested patches may still be accepted for them for
+significant issues.