SECURITY file

= SECURITY.md file =
SECURITY.md is a file where security researchers look into where they want to know how to report a potential security issue to a project confidentially. People who report security issues aren't necessarily developers. They might have limited knowledge of how the project functions and what are the customary communication methods.
In addition to the way to contact the project team, it is also frequent to list releases that receive security fixes.
Security researchers prefer confidential reporting and generally avoid posting them publicly -- if they can find a way to report confidentially. This increases the chances of preparing a fix before adversaries exploit the issue.
The file might be straightforward and contain only essential information. Or, it might include links to other security materials, like documentation and policies. It is up to a layer maintainer to decide on the actual content.
== Why to have a SECURITY.md? ==
The first reason to have a SECURITY.md is to offer an easy way for security researchers to contact the project team in case of a potential security vulnerability. The file is the standard way to do it. Many software forges offer special formatting when they detect the file. See, for example, the OE GitHub mirror with the SECURITY.md listed automatically in the 'Security' tab: https://github.com/openembedded/openembedded-core/security
One might argue that Yocto Project layers contain only links to upstream sources, and all security issues should be reported to upstream projects. While it is valid for the first part, layers often include patches or apply configuration options. Such changes might create separate security issues. Finally, a confidential way to contact the project or layer is necessary to synchronize fixes between multiple distributions or downstream projects.
The Yocto Project now strongly recommends all layers to have this file.
== Generic SECURITY.md file ==
The generic SECURITY.md file redirects to the Yocto Project Security Team. Here is an example taken from https://git.openembedded.org/openembedded-core/tree/SECURITY.md :
 
 How to Report a Potential Vulnerability?
 ========================================
 If you would like to report a public issue (for example, one with a released
 CVE number), please report it using the
 Security Bugzilla
 If you are dealing with a not-yet released or urgent issue, please send a
 message to security AT yoctoproject DOT org, including as many details as
 possible: the layer or software module affected, the recipe and its version,
 and any example code, if available.
 Branches maintained with security fixes
 ---------------------------------------
 See Stable release and LTS
 for detailed info regarding the policies and maintenance of Stable branches.
 The Release page contains a list of all
 releases of the Yocto Project. Versions in grey are no longer actively maintained with
 security patches, but well-tested patches may still be accepted for them for
 significant issues.
 
== Layer-specific SECURITY.md file ==
A template asking to contact the maintainer. Adapt to your needs and processes:
 
 How to Report a Potential Vulnerability?
 ========================================
 If you would like to report a public issue (for example, one with a released
 CVE number), please get in touch with the layer maintainer:
 jane DOT doe AT example DOT org.
 Branches maintained with security fixes
 ---------------------------------------
 This project follows Yocto Project LTS policy. Please refer to the YP documentation
 for more details.