root: rework and expand security policy

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
2022-11-28 12:10:53 +01:00 · 2022-11-28 12:10:53 +01:00 · 147ebf1a5e
parent e22fce02f8
commit 147ebf1a5e
6 changed files with 97 additions and 53 deletions
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@ -17,23 +17,23 @@ diverse, inclusive, and healthy community.
 Examples of behavior that contributes to a positive environment for our
 community include:

-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
+-   Demonstrating empathy and kindness toward other people
+-   Being respectful of differing opinions, viewpoints, and experiences
+-   Giving and gracefully accepting constructive feedback
+-   Accepting responsibility and apologizing to those affected by our mistakes,
    and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
+-   Focusing on what is best not just for us as individuals, but for the
    overall community

 Examples of unacceptable behavior include:

-* The use of sexualized language or imagery, and sexual attention or
+-   The use of sexualized language or imagery, and sexual attention or
    advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
+-   Trolling, insulting or derogatory comments, and personal or political attacks
+-   Public or private harassment
+-   Publishing others' private information, such as a physical or email
    address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
+-   Other conduct which could reasonably be considered inappropriate in a
    professional setting

 ## Enforcement Responsibilities
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -11,19 +11,22 @@ The following is a set of guidelines for contributing to authentik and its compo
 [I don't want to read this whole thing, I just have a question!!!](#i-dont-want-to-read-this-whole-thing-i-just-have-a-question)

 [What should I know before I get started?](#what-should-i-know-before-i-get-started)
-  * [The components](#the-components)
-  * [authentik's structure](#authentiks-structure)
+
+-   [The components](#the-components)
+-   [authentik's structure](#authentiks-structure)

 [How Can I Contribute?](#how-can-i-contribute)
-  * [Reporting Bugs](#reporting-bugs)
-  * [Suggesting Enhancements](#suggesting-enhancements)
-  * [Your First Code Contribution](#your-first-code-contribution)
-  * [Pull Requests](#pull-requests)
+
+-   [Reporting Bugs](#reporting-bugs)
+-   [Suggesting Enhancements](#suggesting-enhancements)
+-   [Your First Code Contribution](#your-first-code-contribution)
+-   [Pull Requests](#pull-requests)

 [Styleguides](#styleguides)
-  * [Git Commit Messages](#git-commit-messages)
-  * [Python Styleguide](#python-styleguide)
-  * [Documentation Styleguide](#documentation-styleguide)
+
+-   [Git Commit Messages](#git-commit-messages)
+-   [Python Styleguide](#python-styleguide)
+-   [Documentation Styleguide](#documentation-styleguide)

 ## Code of Conduct

@ -39,11 +42,11 @@ Either [create a question on GitHub](https://github.com/goauthentik/authentik/is

 authentik consists of a few larger components:

- *authentik* the actual application server, is described below.
- *outpost-proxy* is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
- *outpost-ldap* is a Go LDAP server that uses the *authentik* application server as its backend
- *web* is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
- *website* is the Website/documentation, which uses docusaurus.
+-   _authentik_ the actual application server, is described below.
+-   _outpost-proxy_ is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
+-   _outpost-ldap_ is a Go LDAP server that uses the _authentik_ application server as its backend
+-   _web_ is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
+-   _website_ is the Website/documentation, which uses docusaurus.

 ### authentik's structure

@ -154,10 +157,10 @@ While the prerequisites above must be satisfied prior to having your pull reques

 ### Git Commit Messages

-* Use the format of `<package>: <verb> <description>`
+-   Use the format of `<package>: <verb> <description>`
    -   See [here](#authentik-packages) for `package`
    -   Example: `providers/saml2: fix parsing of requests`
-* Reference issues and pull requests liberally after the first line
+-   Reference issues and pull requests liberally after the first line

 ### Python Styleguide

@ -165,11 +168,11 @@ All Python code is linted with [black](https://black.readthedocs.io/en/stable/),

 authentik runs on Python 3.9 at the time of writing this.

-* Use native type-annotations wherever possible.
-* Add meaningful docstrings when possible.
-* Ensure any database migrations work properly from the last stable version (this is checked via CI)
-* If your code changes central functions, make sure nothing else is broken.
+-   Use native type-annotations wherever possible.
+-   Add meaningful docstrings when possible.
+-   Ensure any database migrations work properly from the last stable version (this is checked via CI)
+-   If your code changes central functions, make sure nothing else is broken.

 ### Documentation Styleguide

-* Use [MDX](https://mdxjs.com/) whenever appropriate.
+-   Use [MDX](https://mdxjs.com/) whenever appropriate.
--- a/README.md
+++ b/README.md
@ -25,10 +25,10 @@ For bigger setups, there is a Helm Chart [here](https://github.com/goauthentik/h

 ## Screenshots

-Light | Dark
--- | ---
-![](https://goauthentik.io/img/screen_apps_light.jpg) | ![](https://goauthentik.io/img/screen_apps_dark.jpg)
-![](https://goauthentik.io/img/screen_admin_light.jpg) | ![](https://goauthentik.io/img/screen_admin_dark.jpg)
+| Light                                                  | Dark                                                  |
+| ------------------------------------------------------ | ----------------------------------------------------- |
+| ![](https://goauthentik.io/img/screen_apps_light.jpg)  | ![](https://goauthentik.io/img/screen_apps_dark.jpg)  |
+| ![](https://goauthentik.io/img/screen_admin_light.jpg) | ![](https://goauthentik.io/img/screen_admin_dark.jpg) |

 ## Development

--- a/SECURITY.md
+++ b/SECURITY.md
@ -1,17 +1,43 @@
-# Security Policy
+Authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.

 ## Supported Versions

 (.x being the latest patch release for each version)

 | Version   | Supported          |
-| ---------- | ------------------ |
+| --------- | ------------------ |
 | 2022.10.x | :white_check_mark: |
 | 2022.11.x | :white_check_mark: |

 ## Reporting a Vulnerability

-To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io)
+To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the bug.
+
+## Criticality levels
+
+### High
+
+-   Authorization bypass
+-   Circumvention of policies
+
+### Moderate
+
+-   Denial-of-Service attacks
+
+### Low
+
+-   Unvalidated redirects
+-   Issues requiring uncommon setups
+
+## Disclosure process
+
+1. Issue is reported via Email as listed above.
+2. The authentik Security team will try to reproduce the issue and ask for more information if required.
+3. A criticality level is assigned.
+4. A fix is created, and if possible tested by the issue reporter.
+5. The fix is backported to other supported versions, and if possible a workaround for other versions is created.
+6. An announcement is sent out with a fixed release date and criticality level of the issue. The announcement will be sent at least 24 hours before the release of the fix
+7. The fixed version is released for the supported versions.

 ## Getting security notifications

--- a/website/docs/security/policy.mdx
+++ b/website/docs/security/policy.mdx
@ -0,0 +1,5 @@
+# Security Policy
+
+import SecurityPolicy from "../../../SECURITY.md";
+
+<SecurityPolicy />
--- a/website/sidebars.js
+++ b/website/sidebars.js
@ -282,5 +282,15 @@ module.exports = {
                "troubleshooting/missing_admin_group",
            ],
        },
+        {
+            type: "category",
+            label: "Security",
+            link: {
+                type: "generated-index",
+                title: "Security",
+                slug: "security",
+            },
+            items: ["security/policy"],
+        },
    ],
 };