mirror of
https://github.com/Awuqing/BackupX.git
synced 2026-08-28 19:47:27 +08:00
41 lines
2.0 KiB
Markdown
41 lines
2.0 KiB
Markdown
# 安全策略 / Security Policy
|
|
|
|
## 支持范围 / Supported Versions
|
|
|
|
安全修复面向最新稳定版本和 `main` 分支。旧版本不会单独维护安全补丁；升级前请先阅读对应 Release Notes 和升级恢复文档。
|
|
|
|
Security fixes target the latest stable release and the `main` branch. Older versions do not receive separate security patches. Review the release notes and upgrade documentation before updating.
|
|
|
|
| Version | Status |
|
|
|---------|--------|
|
|
| Latest stable release | Supported |
|
|
| `main` | Development support |
|
|
| Older releases | Unsupported |
|
|
|
|
## 报告漏洞 / Reporting a Vulnerability
|
|
|
|
请勿通过公开 Issue、Discussion 或 Pull Request 披露安全漏洞。使用 GitHub 的[私密漏洞报告入口](https://github.com/Awuqing/BackupX/security/advisories/new)提交报告。
|
|
|
|
Do not disclose vulnerabilities in a public Issue, Discussion, or Pull Request. Submit the report through GitHub's [private vulnerability reporting form](https://github.com/Awuqing/BackupX/security/advisories/new).
|
|
|
|
报告应包含：
|
|
|
|
1. 受影响版本或提交；
|
|
2. 漏洞描述、攻击前提和影响范围；
|
|
3. 最小复现步骤或验证代码；
|
|
4. 已知缓解措施；
|
|
5. 希望使用的署名信息。
|
|
|
|
不要上传真实密钥、Token、备份数据、数据库或包含客户信息的日志。必要时请先脱敏，并使用最小化测试数据。
|
|
|
|
Do not upload real credentials, tokens, backup data, databases, or logs containing customer information. Redact sensitive values and use minimal test data.
|
|
|
|
## 处理流程 / Response Process
|
|
|
|
- 维护者会尽快确认报告并进行初步分级；
|
|
- 修复期间请保持细节私密，避免影响仍未升级的部署；
|
|
- 修复发布后会在安全公告或 Release Notes 中说明受影响范围、缓解措施和升级版本；
|
|
- 披露时间由报告者与维护者协调确定。
|
|
|
|
The maintainer will acknowledge and triage the report as soon as practical. Details should remain private until a fix and coordinated disclosure are ready.
|