From 98b5f2951ed47659d55f9d9bed32b6f14aeb11e5 Mon Sep 17 00:00:00 2001 From: "Erik Osterman (Cloud Posse)" Date: Wed, 2 Sep 2026 08:46:03 -0500 Subject: [PATCH] docs: publish vulnerability remediation targets Adds severity-based remediation targets to the organization security policy, scoped to actively maintained products. Requested during the Atmos supply-chain security assessment, where a published SLA is expected evidence. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Uaxw8BszrDDBNmyFTcDrTx --- SECURITY.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 4199a77e..cd6cc69f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -32,6 +32,19 @@ After you submit a report, we will endeavor to: - Provide an estimated time frame for addressing the vulnerability. - Notify you when the issue is resolved. +## Remediation Targets + +These targets apply to Cloud Posse's actively maintained software products, including the Atmos CLI. + +| Severity | Target | +| --- | --- | +| Critical | 7 days, or 72 hours where the vulnerability is reachable in the product and an upstream fix is available | +| High | 30 days | +| Medium | 90 days | +| Low | Next regular release | + +Targets are measured from confirmation of the vulnerability rather than from the date it was reported. + ## Supported Versions Given the nature of our open-source projects, we generally support only the latest major version of each project. However, critical security patches may be applied to older versions at our discretion. @@ -43,4 +56,3 @@ We deeply value the contributions and efforts of security researchers and the wi We are committed to working with the community in a transparent and collaborative manner. We recognize the efforts of those who responsibly disclose vulnerabilities and will ensure they receive acknowledgment for their contributions in our project documentation or other public communications, as appropriate. Thank you for your support in keeping Cloud Posse and the open source ecosystem secure! -