Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Support and Security metadata pages #1

Merged
merged 3 commits into from
Jul 28, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions SECURITY.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
# Security Policy

## Reporting Security Issues

You can submit any security issue or suspected vulnerability
on the GitHub Security pages of the project.
Comment on lines +5 to +6
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like I'm missing something here. I would expect [email protected] here. Or is there a way to have some kind of "private issues" in GitHub for security?

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! TIL.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is something we should add to the project onboarding checklist IMHO.
But yeah, it becomes a useful thing for small projects

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do **NOT** use public GitHub Issues for reporting vulnerabilities.

## Bug Bounty

Unless documented explicitly,
GradleUp projects are not a part of
any security bug bounty program and,
as of now, of any other program.

For confirmed issues, we will be happy to credit you in the public Security Advisory and on social media.
44 changes: 44 additions & 0 deletions SUPPORT.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
# Support for GradleUp projects

Any bug reports, feature requests and comments are welcome!
The project keeps evolving,
and any feedback from end users and developers will be appreciated.

## Raising Issues and Feature Requests

Use GitHub Issues.
Note that it may take some time to get a response, thanks for your patience.
Contributions are always welcome, see the Contributor Guidelines.

## Reporting Security Issues

Please do NOT use public GitHub Issues for reporting vulnerabilities.
You can submit any security issue or suspected vulnerability on GitHub Security pages,
which are available in project repositories.
Read More - [Security Policy](./SECURITY.md).

## Setting Expectations

GradleUp is a community driven project,
most of contributors and maintainers invest their personal time.
We do not guarantee a response or resolution
time for the submitted issues.
As it is written in the Apache License v2:
Comment on lines +22 to +26
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍


> Licensor provides the Work (and each Contributor provides its Contributions)
> on an "AS IS" BASIS,
> WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied, including, without limitation, any warranties or conditions
> of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
> PARTICULAR PURPOSE. You are solely responsible for determining the
> appropriateness of using or redistributing the Work and assume any
> risks associated with Your exercise of permissions under this License.

## Commercial Support and Customization

The GradleUp projects prioritize the community support with a best effort,
but do not provide any guarantees or SLAs.
Maintainers of the GradleUp projects **might** be available for additional consulting.
Do not hesitate reaching out to them.

**Protip:** Supporting the work of maintainers and contributors on GitHub Sponsors and other platforms is always appreciated.