Skip to content

docs: add security policy #2127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iamdadmin wants to merge 3 commits into
base: 3.x
Choose a base branch
from
+35 −0
Open

docs: add security policy #2127

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
84c2a7b
docs: add security.md
iamdadmin Apr 27, 2026
fe3d5b7
docs: use Github's advisory reporting mechanism
iamdadmin Apr 27, 2026
e089a15
docs: apply grammar changes as requested
iamdadmin Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
# Tempest security policy

## Reporting a security issue

If you think you have found a security issue within Tempest, don't create a GitHub issue and don't publish a pull request with proof of concept. In the first instance, report issues using [GitHub's security advisory reporting mechanism](https://github.com/tempestphp/tempest-framework/security/advisories/new), with as much information as you can provide, ideally including steps-to-recreate. Security reports submitted on this page are forwarded to the core maintainers only.
Copy link
Copy Markdown
Member

@aidan-casey aidan-casey Jun 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
If you think you have found a security issue within Tempest, don't create a GitHub issue and don't publish a pull request with proof of concept. In the first instance, report issues using [GitHub's security advisory reporting mechanism](https://github.com/tempestphp/tempest-framework/security/advisories/new), with as much information as you can provide, ideally including steps-to-recreate. Security reports submitted on this page are forwarded to the core maintainers only.
If you believe you have discovered a security issue in Tempest, please do not create a GitHub issue or publish a proof-of-concept pull request.
Instead, report the issue using [GitHub's security advisory reporting mechanism](https://github.com/tempestphp/tempest-framework/security/advisories/new) and provide as much detail as possible, including steps to reproduce the issue where applicable. Reports submitted through this process are visible only to the core maintainers.


The core maintainers will determine whether this is classified as a security issue, and address it accordingly, or whether it is classified as a regular bug, and may ask you to raise a GitHub issue instead, at this time.
Copy link
Copy Markdown
Member

@aidan-casey aidan-casey Jun 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The core maintainers will determine whether this is classified as a security issue, and address it accordingly, or whether it is classified as a regular bug, and may ask you to raise a GitHub issue instead, at this time.
The core maintainers will determine whether this is classified as a security issue, and address it accordingly, or whether it is classified as a regular bug, and may ask you to raise a GitHub issue instead.


## Resolution process

The core maintainers will aim to acknowledge and validate any reported security issue promptly.
Copy link
Copy Markdown
Member

@aidan-casey aidan-casey Jun 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The core maintainers will aim to acknowledge and validate any reported security issue promptly.
The core maintainers will acknowledge and validate reported security issues as promptly as possible.


Following the validation of a security issue, the core maintainers will broadly:
Copy link
Copy Markdown
Member

@aidan-casey aidan-casey Jun 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Following the validation of a security issue, the core maintainers will broadly:
Following the validation of a security issue, the core maintainers will:


1. Work on a patch and commit it to the repository via GitHub following the usual processes.

2. Issue a release containing the security release.

3. Consider offering a Rector automated fix within the release, where appropriate.

4. Notify all subscribed Tempest parties via the usual channels (discord, blog, etc) that the updated is published.
Copy link
Copy Markdown
Member

@aidan-casey aidan-casey Jun 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
4. Notify all subscribed Tempest parties via the usual channels (discord, blog, etc) that the updated is published.
4. Notify all subscribed Tempest parties via the usual channels (Discord, blog, etc) that the updated is published.


## Keeping Tempest secure

Several controls are in place to ensure that Tempest code releases are kept secure.

1. All maintainers with write access to the repository use multi-factor authentication.

2. Branch protection is configured on the repository.

3. All access rights and privileges (including automated accounts, API keys) are assigned on a Principle of Least Privilege basis.

4. Every pull request requires the successful completion of code quality and static analysis checks, and is reviewed by a core maintainer.

5. Tempest actively upgrades dependencies based on deprecations and notices from upstream packages where used.
Loading