Skip to content

Fix #7176: [BUG] Security vulnerability: requesting a security contact #7309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brimoor merged 2 commits into from
Apr 6, 2026
+41 −0
Merged

Fix #7176: [BUG] Security vulnerability: requesting a security contact #7309

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
22fe00f
Add SECURITY.md with responsible disclosure policy
JiwaniZakir Apr 5, 2026
4ba9e02
cleanup
brimoor Apr 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
# Security Policy

## Reporting a Vulnerability

The FiftyOne team takes security vulnerabilities seriously. We appreciate your
efforts to responsibly disclose your findings.

**Please do not report security vulnerabilities through public GitHub issues.**

Instead, please report security vulnerabilities by emailing the Voxel51
security team at:

**[email protected]**

You should receive a response within 48 hours. If for some reason you do not,
please follow up via email to ensure we received your original message.

Please include the following information in your report:

- Type of issue (e.g., remote code execution, authentication bypass, etc.)
- The component(s) affected (e.g., server, database, API)
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit it

This information will help us triage your report more quickly.
Comment on lines +16 to +24
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add encrypted communication option for sensitive vulnerabilities.

For high-severity issues (like the unauthenticated network-accessible vulnerability mentioned in #7176), reporters need a way to send encrypted details. Industry best practice is to provide a PGP public key.

📧 Suggested addition after line 13 
 **[email protected]**
+
+For sensitive reports, you may encrypt your message using our PGP key:
+[Link to PGP key or key fingerprint]
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@SECURITY.md` around lines 18 - 26, Add an encrypted communication option for
high-severity reports by updating SECURITY.md to include a PGP public key and
brief instructions for reporters to encrypt sensitive details; specifically, add
a new section (suggested insertion after the existing contact/line 13) that
lists the PGP public key fingerprint and ASCII-armored public key, shows the
exact fields reporters should still include (type of issue, affected components,
reproduction steps, PoC, impact), and instructs how to encrypt their message
(e.g., “encrypt with this PGP key and send to [security@domain]”), plus guidance
on alternative secure channels and a note about accepted file formats for
encrypted attachments.


## Disclosure Policy

When we receive a security bug report, we will:

1. Confirm the problem and determine the affected versions.
2. Audit code to find any similar potential problems.
3. Prepare fixes for all supported releases.
4. Release patched versions as soon as possible.

We kindly ask that you give us a reasonable amount of time to address the
issue before any public disclosure.
Comment thread
brimoor marked this conversation as resolved.

## Supported Versions

We release security fixes for the latest stable version of FiftyOne. We
encourage all users to stay up to date with the latest release.
Comment thread
brimoor marked this conversation as resolved.

## Preferred Languages

We prefer all communications to be in English.
Comment thread
brimoor marked this conversation as resolved.
Outdated