(datafusion-sqlparser-rs) 01/01: Update SECURITY policy to conform to ASF guidelines (#2601)

[gi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-2601-287aaf6d5c25ae47572ce2400ecb61faf257a697
in repository https://gitbox.apache.org/repos/asf/datafusion-sqlparser-rs.git

commit 811ef298c59088d5933bf7f266d5864013ffa720
Author: Andrew Lamb <an...@nerdnetworks.org>
AuthorDate: Thu Oct 1 17:06:58 2026 +0000

    Update SECURITY policy to conform to ASF guidelines (#2601)
    
    Co-authored-by: Copilot <22...@users.noreply.github.com>
---
 SECURITY.md | 37 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/SECURITY.md b/SECURITY.md
index 662ab74f0..c83785a1c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -19,6 +19,41 @@
 
 # Security Policy
 
+This document outlines the security model for `sqlparser-rs` and how to
+report vulnerabilities.
+
+## Security Model
+
+`sqlparser-rs` parses SQL text, which is often untrusted input (e.g., a query
+string from a user or external system). The parser is expected to reject invalid
+or malformed SQL with an error.
+
+Unexpected behavior triggered by malformed or adversarial input is generally
+considered a **bug**, not a security vulnerability, unless it is *exploitable**
+and could allow an attacker to
+
+* Execute arbitrary code (Remote Code Execution);
+* Exfiltrate sensitive information from process memory (Information Disclosure);
+
+For example, panics, crashes, stack overflows, excessive resource consumption,
+or infinite loops are generally considered bugs, unless they can be exploited to
+achieve one of the above security goals.  If that exploitation path is unclear,
+the issue should likely be reported as a bug.
+
+## Reporting a Bug
+
+We treat all bugs seriously and welcome help fixing them. If you find a bug
+that does not meet the criteria for a security vulnerability, please report it
+in the public issue tracker.
+
 ## Reporting a Vulnerability
 
-Please report security issues to `andrew@nerdnetworks.org`
\ No newline at end of file
+For security vulnerabilities, **do not file a public issue.** 
+Follow the [ASF security reporting process] by emailing [security@apache.org](mailto:security@apache.org).
+
+Include in your report:
+- A clear description and minimal reproducer.
+- Affected crates and versions.
+- A demonstration of the potential impact.
+
+[ASF security reporting process]: https://www.apache.org/security/#reporting-a-vulnerability
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@datafusion.apache.org
For additional commands, e-mail: commits-help@datafusion.apache.org