From 2075683b4a1893a92b0b5bcacb9924b6e26a8d03 Mon Sep 17 00:00:00 2001 From: Grigory Pomadchin Date: Sat, 1 Aug 2026 20:19:58 -0400 Subject: [PATCH] Add SECURITY.md --- SECURITY.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..4581220 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,37 @@ +# Security Policy + +Proj4J is a LocationTech project and adheres to the +[Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/). +Vulnerabilities are tracked by the Eclipse security team, in cooperation with the Proj4J committers. +Fixing vulnerabilities is done by the Proj4J committers, with assistance and guidance from the security team. + +## How To Report a Vulnerability + +If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure: + +* [Create a confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/new?issuable_template=new_vulnerability) + in the Eclipse Foundation Vulnerability Reporting Tracker + +**Please do not report security vulnerabilities through public issues, discussions, or change requests.** + +You can find more information about reporting and disclosure at the +[Eclipse Foundation Security page](https://www.eclipse.org/security/). + +Please include as much of the information listed below as you can to help us better understand and resolve the issue: + +* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) +* Affected version(s) +* Impact of the issue, including how an attacker might exploit the issue +* Step-by-step instructions to reproduce the issue +* The location of the affected source code (tag/branch/commit or direct URL) +* Full paths of source file(s) related to the manifestation of the issue +* Configuration required to reproduce the issue +* Log files that are related to this issue (if possible) +* Proof-of-concept or exploit code (if possible) + +This information will help us triage your report more quickly. + +## Supported Versions + +The Proj4J committers will evaluate the impact and scope of any vulnerabilities with guidance from the Eclipse +security team, and apply patches to previous releases as deemed necessary.