Luke HeathandCopilot Autofix powered by AI
35a0107cd8
@allenhouchins Documenting our VDP ## Summary - Adds a pointer to Fleet's public Bugbop Vulnerability Disclosure Program from `SECURITY.md` and `handbook/it/security.md`. - Documents the program's in-scope, out-of-scope, and typically-not-eligible categories so researchers can self-triage before submitting. - Keeps `security@fleetdm.com` as the channel for coordinated, non-public disclosure. Motivation: two recent informal disclosures (missing CAA, missing MTA-STS) revealed that our published policy made no mention of the VDP or its scope, which left the boundary ambiguous when declining out-of-scope submissions. ## Test plan - [ ] Verify rendered `SECURITY.md` on the repo's Security tab links to the Bugbop program. - [ ] Verify the handbook page renders the new VDP paragraph in the "Disclosure" section without breaking surrounding structure. - [ ] Confirm no internal/private program details are referenced. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2.2 KiB
Security Policy
Reporting a Vulnerability
Fleet runs a Vulnerability Disclosure Program (VDP) on Bugbop:
https://bugbop.com/programs/b5f2f20e-fe4d-466b-a474-6db65b4d2bb3
Please review the program scope and rules of engagement on Bugbop before submitting. Researchers can also report vulnerabilities directly to security at fleetdm.com (PGP key below) for coordinated, non-public disclosure.
Fleet endeavors to acknowledge and fix any reported vulnerabilities ASAP. Acknowledgement is typically within 1 business day, and patches usually go out within 5 business days (depending on severity and timing).
Scope
In scope:
- Fleet product source code: github.com/fleetdm/fleet
- Fleet REST API documentation: fleetdm.com/docs/rest-api/rest-api
Out of scope:
- Marketing pages, blogs, and landing pages on fleetdm.com
- Third-party hosted services (unless they directly impact a primary in-scope asset)
- Physical offices and infrastructure
- Employee social media accounts
Reports that are typically not eligible:
- Missing HTTP security headers (unless they lead to a proven, demonstrated vulnerability)
- Theoretical vulnerabilities without proof of exploitation
- Automated tool output without clear impact evidence
- Self-XSS requiring significant user interaction
- Issues solely affecting outdated browsers
PGP Key
To encrypt vulnerability reports before sending them, please use this PGP key.
The fingerprint of the key is 82F2 AF19 547E 462A 4605 D538 01B2 575E 4676 6EBE.
Vulnerability tracking
GitHub issues concerning vulnerabilities will be tagged with the security label to differentiate them from other issues and maintain SOC2 compliance.
See security/README.md for more information on our process to keep Fleet products secure.
Compatibility
Fleet reserves the right to make breaking changes for security. Security fixes may introduce backward-incompatible changes and may be released in minor or patch versions.