(logging-site) branch main updated: Add reporting guidelines to the security page (#44)

[pk...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

ppkarwasz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/logging-site.git


The following commit(s) were added to refs/heads/main by this push:
     new 67d4ea65 Add reporting guidelines to the security page (#44)
67d4ea65 is described below

commit 67d4ea6589ccadf71555d29f26a4eb34bf612b21
Author: Piotr P. Karwasz <pk...@apache.org>
AuthorDate: Thu Sep 17 21:32:56 2026 +0200

    Add reporting guidelines to the security page (#44)
    
    The "Reporting vulnerabilities" section only pointed reporters to the private security mailing list. It now summarizes the reporting guidelines of the ASF Security Team and links to them: prefix the subject line with `[SECURITY]`, report one finding per e-mail, write the report in plain text and avoid attachments whose content fits in the body of the e-mail. It also states the disclosure terms that apply to every report: the information may be made public after triage (for invalid rep [...]
    
    The "Vulnerability handling" section gets a minor wording cleanup.
    
    Assisted-By: Claude Fable 5.1 <no...@anthropic.com>
---
 src/site/antora/modules/ROOT/pages/security.adoc | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/site/antora/modules/ROOT/pages/security.adoc b/src/site/antora/modules/ROOT/pages/security.adoc
index 662c3925..e9b20f64 100644
--- a/src/site/antora/modules/ROOT/pages/security.adoc
+++ b/src/site/antora/modules/ROOT/pages/security.adoc
@@ -39,7 +39,17 @@ These instructions can be found in `BUILDING.adoc`, `BUILDING.md`, etc. files di
 [#reporting]
 == Reporting vulnerabilities
 
-If you have encountered an unlisted security vulnerability or other unexpected behaviour that has a security impact, or if the descriptions here are incomplete, please report them **privately** to mailto:security@logging.apache.org[the Logging Services Security Team].
+If you have encountered an unlisted security vulnerability or other unexpected behavior that has a security impact, or if the descriptions here are incomplete, please report them **privately** to mailto:security@logging.apache.org[the Logging Services Security Team].
+
+Reports should follow the https://security.apache.org/report-code/[reporting guidelines of the ASF Security Team]:
+
+- Start the subject line with `[SECURITY]` so that your report is not mistaken for spam.
+- Report only one finding per e-mail.
+- Write your report in plain text.
+- Do not attach documents (DOCX, PDF, Markdown, etc.) whose content could just as easily be included in the body of the e-mail.
+
+By sending a report, you agree that the information it contains may be made public, either after triage (for invalid reports) or after the release of a fix, unless you explicitly request otherwise.
+If your report turns out to be invalid, your identity will not be disclosed, unless you explicitly request otherwise.
 
 [IMPORTANT]
 ====
@@ -59,8 +69,8 @@ include::_threat-model-common.adoc[leveloffset=+1]
 
 The Logging Services Security Team follows the https://www.apache.org/security/committers.html[ASF Project Security] guide for handling security vulnerabilities.
 
-Reported security vulnerabilities are subject to voting (by means of https://logging.apache.org/guidelines.html[_lazy approval_], preferably) in the private mailto:security@logging.apache.org[security mailing list] before creating a CVE and populating its associated content.
-This procedure involves only the creation of CVEs and blocks neither (vulnerability) fixes, nor releases.
+Reported security vulnerabilities are subject to voting (preferably by https://logging.apache.org/guidelines.html[_lazy approval_]) in the private mailto:security@logging.apache.org[security mailing list] before creating a CVE and populating its associated content.
+This procedure involves only the creation of CVEs and blocks neither (vulnerability) fixes nor releases.
 
 [#vdr]
 == Vulnerability Disclosure Report (VDR)