From 647507f42f0b71b1e4fd9da4e1d8825742cec3aa Mon Sep 17 00:00:00 2001 From: alangou Date: Thu, 22 Oct 2026 15:27:40 +0200 Subject: [PATCH 1/4] docs(security): use GitHub private vulnerability reporting Signed-off-by: Adrien Langou --- SECURITY.md | 50 +++++++++++++++++++++++++++++++++----------------- 1 file changed, 33 insertions(+), 17 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 76ba2ce72d..d35a8ab44d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,25 +1,41 @@ -# Security +# Security Policy -NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization. +## Reporting a vulnerability -If you need to report a security issue, please use the appropriate contact points outlined below. **Please do not report security vulnerabilities through GitHub.** If a potential security issue is inadvertently reported via a public issue or pull request, NVIDIA maintainers may limit public discussion and redirect the reporter to the appropriate private disclosure channels. +Report OpenShell vulnerabilities through [GitHub's private reporting form](https://github.com/NVIDIA/OpenShell/security/advisories/new). Submitting a report does not publish an advisory. Do not disclose vulnerabilities in public issues, discussions, or pull requests. -## Reporting Potential Security Vulnerability in an NVIDIA Product +Include: -To report a potential security vulnerability in any NVIDIA product: +- Affected component and version, commit, or image digest. +- Description, impact, and prerequisites for exploitation. +- Reproduction steps or a minimal proof of concept. +- Relevant deployment and policy configuration, with secrets and personal information removed. +- Known mitigations, existing CVE identifiers, or disclosure deadlines, if any. -- Web: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html) -- E-Mail: psirt@nvidia.com - - We encourage you to use the following PGP key for secure email communication: [NVIDIA public PGP Key for communication](https://www.nvidia.com/en-us/security/pgp-key) - - Please include the following information: - - Product/Driver name and version/branch that contains the vulnerability - - Type of vulnerability (code execution, denial of service, buffer overflow, etc.) - - Instructions to reproduce the vulnerability - - Proof-of-concept or exploit code - - Potential impact of the vulnerability, including how an attacker could exploit the vulnerability +The [OpenShell maintainers](https://github.com/NVIDIA/OpenShell/blob/main/MAINTAINERS.md) acknowledge and assess reports, request additional details when needed, and coordinate remediation. Follow-up discussions, decisions, and progress updates remain in the private report or advisory thread. -While NVIDIA currently does not have a bug bounty program, we do offer acknowledgement when an externally reported security issue is addressed under our coordinated vulnerability disclosure policy. Please visit our [Product Security Incident Response Team (PSIRT)](https://www.nvidia.com/en-us/security/psirt-policies/) policies page for more information. +## Coordinated disclosure -## NVIDIA Product Security +The maintainers and reporter agree on a disclosure date after assessment. Keep details confidential until that date; any extension is discussed with the reporter. Access is limited to people involved in investigation, remediation, or coordination. -For all security-related concerns, please visit NVIDIA's Product Security portal at https://www.nvidia.com/en-us/security +We aim to publish an advisory with a fix or mitigation. Active exploitation or details already being public may require earlier notification. Advisories explain when a fix is unavailable and identify known mitigations. + +When applicable, maintainers coordinate a CVE with the appropriate numbering authority and reuse an existing identifier. + +## Supported versions + +In line with [RFC 0014](https://github.com/NVIDIA/OpenShell/blob/main/rfc/0014-release-stability/README.md#maintenance-and-backports), security support applies to the newest patch of each maintained line: + +| Release line | Security updates | +| --- | --- | +| Latest stable minor (N) | New patch releases. | +| Previous stable minor (N-1) | Backports when affected. | +| Older minor releases | Upgrade to a maintained line. | + +Users of older patches must upgrade to the current maintenance patch. Security fixes may ship outside the regular release cadence. + +Pre-release and development builds are for testing. Reports affecting them or older releases are still welcome. + +## Security bulletins + +Published [GitHub Security Advisories (GHSA)](https://github.com/NVIDIA/OpenShell/security/advisories) describe impact, affected and fixed versions, and mitigation or upgrade instructions. From fedaa27932b6604e9fa22a54287991983ddc8d2d Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Mon, 26 Oct 2026 10:24:48 +0100 Subject: [PATCH 2/4] docs(security): clarify report quality and advisory workflows Signed-off-by: Adrien Langou --- SECURITY.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index d35a8ab44d..ee814335fe 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -14,6 +14,12 @@ Include: The [OpenShell maintainers](https://github.com/NVIDIA/OpenShell/blob/main/MAINTAINERS.md) acknowledge and assess reports, request additional details when needed, and coordinate remediation. Follow-up discussions, decisions, and progress updates remain in the private report or advisory thread. +### Report quality and agent skills + +AI tools are welcome for investigation and drafting, consistent with our [AI usage guidelines](CONTRIBUTING.md#ai-usage). You remain responsible for understanding the finding and verifying the report's accuracy. Explain the issue in your own words, distinguish reproduced behavior, code inspection, and unverified claims, and include concise evidence excerpts. Raw scanner output or agent transcripts alone are not sufficient. + +Use the optional [advisory template](.agents/skills/create-security-advisory/assets/advisory-template.md) to structure the report. With a source checkout, [create-security-advisory](.agents/skills/create-security-advisory/SKILL.md) helps prepare it; maintainers can use [review-security-issue](.agents/skills/review-security-issue/SKILL.md) for assessment. Submit reports through the private form above. + ## Coordinated disclosure The maintainers and reporter agree on a disclosure date after assessment. Keep details confidential until that date; any extension is discussed with the reporter. Access is limited to people involved in investigation, remediation, or coordination. From aea72dc3f8e98b5bd441911dd4ef97ade7321832 Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Mon, 26 Oct 2026 10:36:56 +0100 Subject: [PATCH 3/4] docs(security): require structured evidence-backed reports Signed-off-by: Adrien Langou --- SECURITY.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index ee814335fe..26bcb6852e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,11 +4,11 @@ Report OpenShell vulnerabilities through [GitHub's private reporting form](https://github.com/NVIDIA/OpenShell/security/advisories/new). Submitting a report does not publish an advisory. Do not disclose vulnerabilities in public issues, discussions, or pull requests. -Include: +Every report must use the [advisory template](.agents/skills/create-security-advisory/assets/advisory-template.md). Keep its core headings and include: - Affected component and version, commit, or image digest. - Description, impact, and prerequisites for exploitation. -- Reproduction steps or a minimal proof of concept. +- Reproduction steps and observed results, or concrete code evidence of the attack path. - Relevant deployment and policy configuration, with secrets and personal information removed. - Known mitigations, existing CVE identifiers, or disclosure deadlines, if any. @@ -16,9 +16,11 @@ The [OpenShell maintainers](https://github.com/NVIDIA/OpenShell/blob/main/MAINTA ### Report quality and agent skills -AI tools are welcome for investigation and drafting, consistent with our [AI usage guidelines](CONTRIBUTING.md#ai-usage). You remain responsible for understanding the finding and verifying the report's accuracy. Explain the issue in your own words, distinguish reproduced behavior, code inspection, and unverified claims, and include concise evidence excerpts. Raw scanner output or agent transcripts alone are not sufficient. +AI tools may assist investigation and drafting under our [AI usage guidelines](CONTRIBUTING.md#ai-usage). A human reporter must review the report, verify its accuracy, and be able to explain the attack scenario and supporting evidence. Distinguish reproduced behavior, code inspection, and unverified claims. Raw scanner output, agent transcripts, or speculative vulnerability lists alone are not sufficient. -Use the optional [advisory template](.agents/skills/create-security-advisory/assets/advisory-template.md) to structure the report. With a source checkout, [create-security-advisory](.agents/skills/create-security-advisory/SKILL.md) helps prepare it; maintainers can use [review-security-issue](.agents/skills/review-security-issue/SKILL.md) for assessment. Submit reports through the private form above. +Reports that do not follow the template or lack concrete reproduction or code evidence will be returned for revision before technical triage. Identify missing information explicitly; a root cause, CVSS/CWE classification, or proposed fix is not required. + +The agent skills are optional helpers: with a source checkout, [create-security-advisory](.agents/skills/create-security-advisory/SKILL.md) helps prepare a report; maintainers can use [review-security-issue](.agents/skills/review-security-issue/SKILL.md) for assessment. Submit reports through the private form above. ## Coordinated disclosure From 59d0e3d70bf042128783ce3b1a48d14b1a44fd5c Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Mon, 26 Oct 2026 10:56:21 +0100 Subject: [PATCH 4/4] docs(security): remove CVE coordination wording Signed-off-by: Adrien Langou --- SECURITY.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 26bcb6852e..8989f2c474 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -28,8 +28,6 @@ The maintainers and reporter agree on a disclosure date after assessment. Keep d We aim to publish an advisory with a fix or mitigation. Active exploitation or details already being public may require earlier notification. Advisories explain when a fix is unavailable and identify known mitigations. -When applicable, maintainers coordinate a CVE with the appropriate numbering authority and reuse an existing identifier. - ## Supported versions In line with [RFC 0014](https://github.com/NVIDIA/OpenShell/blob/main/rfc/0014-release-stability/README.md#maintenance-and-backports), security support applies to the newest patch of each maintained line: