Bug 40527

Summary: Add SECURITY.md to Koha
Product: Koha Reporter: David Cook <dcook>
Component: Architecture, internals, and plumbingAssignee: David Cook <dcook>
Status: Pushed to main --- QA Contact: Lisette Scheer <lisette>
Severity: enhancement    
Priority: P5 - low CC: lisette, lucas, ludovic.julien
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
This enhancement adds a markdown file to the Koha project repository to make it clear how to report security issues.
Version(s) released in:
25.11.00
Circulation function:
Attachments: Bug 40527: Initial draft of SECURITY.md
Bug 40527: Initial draft of SECURITY.md
Bug 40527: Initial draft of SECURITY.md
Bug 40527: Add SECURITY.md to ignored list in MakeFile.t

Description David Cook 2025-07-28 04:11:56 UTC
We should consider adding a SECURITY.md document to the Koha git repository to give people insight into how to report security issues for Koha.

https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
Comment 1 David Cook 2025-07-28 04:46:20 UTC
Created attachment 184701 [details] [review]
Bug 40527: Initial draft of SECURITY.md

This patch includes an initial draft of a proposed SECURITY.md
guideline for reporting security bugs to Koha.
Comment 2 Lin Wei 2025-09-04 20:13:53 UTC
Created attachment 186183 [details] [review]
Bug 40527: Initial draft of SECURITY.md

This patch includes an initial draft of a proposed SECURITY.md
guideline for reporting security bugs to Koha.

Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com>
Comment 3 Ludovic 2025-09-04 20:14:48 UTC
This is a great addition!

Having a clear and well-documented SECURITY.md makes it easier for community members to report vulnerabilities responsibly and helps ensure timely responses.

I especially appreciate the clear step-by-step instructions and the reminder about keeping private information out of summaries.

One possible improvement could be to explicitly list the expected response time range (even approximate), so reporters know what to expect.

Overall, this is a very useful and important patch for improving Koha's security posture.
Comment 4 David Cook 2025-09-05 02:51:17 UTC
(In reply to Ludovic from comment #3)
> This is a great addition!

Thanks, Ludovic!
 
> One possible improvement could be to explicitly list the expected response
> time range (even approximate), so reporters know what to expect.

It's a good suggestion. I did think about that, but I couldn't come up with a good answer. The best I could do was "as quickly as possible". 

Personally, I try to respond as soon as I see one has been raised, which is usually within 24-72 hours I think, but sometimes I'm not available (whether it's holiday, sickness, or other work commitments) or maybe I don't see it due to an email glitch.

Maybe that's something we can discuss further in the community.
Comment 5 Lisette Scheer 2025-09-26 17:05:28 UTC
Created attachment 186993 [details] [review]
Bug 40527: Initial draft of SECURITY.md

This patch includes an initial draft of a proposed SECURITY.md
guideline for reporting security bugs to Koha.

Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Comment 6 Lisette Scheer 2025-09-26 17:05:56 UTC
I think that would be a good community discussion. Maybe the next General meeting?
Comment 7 David Cook 2025-09-28 23:20:28 UTC
(In reply to Lisette Scheer from comment #6)
> I think that would be a good community discussion. Maybe the next General
> meeting?

I can never make the meetings but wouldn't hurt
Comment 8 Lucas Gass (lukeg) 2025-10-09 21:01:59 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 9 Lucas Gass (lukeg) 2025-10-09 22:40:48 UTC
kohadev-koha@kohadevbox:koha(main)$ prove -v /kohadevbox/koha/t/Makefile.t
/kohadevbox/koha/t/Makefile.t .. 
1..3
ok 1 - We should test something
not ok 2 - All directories should be mapped: SECURITY.md

#   Failed test 'All directories should be mapped: SECURITY.md'
#   at /kohadevbox/koha/t/Makefile.t line 53.
#          got: '1'
#     expected: '0'
ok 3 - no warnings
# Looks like you failed 1 test of 3.
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/3 subtests
Comment 10 Lucas Gass (lukeg) 2025-10-09 22:47:07 UTC
Created attachment 187710 [details] [review]
Bug 40527: Add SECURITY.md to ignored list in MakeFile.t
Comment 11 Lucas Gass (lukeg) 2025-10-09 22:47:58 UTC
follow-up pushed to main