Bug 40527 - Add SECURITY.md to Koha
Summary: Add SECURITY.md to Koha
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: David Cook
QA Contact: Lisette Scheer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-07-28 04:11 UTC by David Cook
Modified: 2025-10-09 22:47 UTC (History)
3 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This enhancement adds a markdown file to the Koha project repository to make it clear how to report security issues.
Version(s) released in:
25.11.00
Circulation function:


Attachments
Bug 40527: Initial draft of SECURITY.md (3.61 KB, patch)
2025-07-28 04:46 UTC, David Cook
Details | Diff | Splinter Review
Bug 40527: Initial draft of SECURITY.md (3.67 KB, patch)
2025-09-04 20:13 UTC, Lin Wei
Details | Diff | Splinter Review
Bug 40527: Initial draft of SECURITY.md (3.72 KB, patch)
2025-09-26 17:05 UTC, Lisette Scheer
Details | Diff | Splinter Review
Bug 40527: Add SECURITY.md to ignored list in MakeFile.t (569 bytes, patch)
2025-10-09 22:47 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2025-07-28 04:11:56 UTC
We should consider adding a SECURITY.md document to the Koha git repository to give people insight into how to report security issues for Koha.

https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
Comment 1 David Cook 2025-07-28 04:46:20 UTC
Created attachment 184701 [details] [review]
Bug 40527: Initial draft of SECURITY.md

This patch includes an initial draft of a proposed SECURITY.md
guideline for reporting security bugs to Koha.
Comment 2 Lin Wei 2025-09-04 20:13:53 UTC
Created attachment 186183 [details] [review]
Bug 40527: Initial draft of SECURITY.md

This patch includes an initial draft of a proposed SECURITY.md
guideline for reporting security bugs to Koha.

Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com>
Comment 3 Ludovic 2025-09-04 20:14:48 UTC
This is a great addition!

Having a clear and well-documented SECURITY.md makes it easier for community members to report vulnerabilities responsibly and helps ensure timely responses.

I especially appreciate the clear step-by-step instructions and the reminder about keeping private information out of summaries.

One possible improvement could be to explicitly list the expected response time range (even approximate), so reporters know what to expect.

Overall, this is a very useful and important patch for improving Koha's security posture.
Comment 4 David Cook 2025-09-05 02:51:17 UTC
(In reply to Ludovic from comment #3)
> This is a great addition!

Thanks, Ludovic!
 
> One possible improvement could be to explicitly list the expected response
> time range (even approximate), so reporters know what to expect.

It's a good suggestion. I did think about that, but I couldn't come up with a good answer. The best I could do was "as quickly as possible". 

Personally, I try to respond as soon as I see one has been raised, which is usually within 24-72 hours I think, but sometimes I'm not available (whether it's holiday, sickness, or other work commitments) or maybe I don't see it due to an email glitch.

Maybe that's something we can discuss further in the community.
Comment 5 Lisette Scheer 2025-09-26 17:05:28 UTC
Created attachment 186993 [details] [review]
Bug 40527: Initial draft of SECURITY.md

This patch includes an initial draft of a proposed SECURITY.md
guideline for reporting security bugs to Koha.

Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Comment 6 Lisette Scheer 2025-09-26 17:05:56 UTC
I think that would be a good community discussion. Maybe the next General meeting?
Comment 7 David Cook 2025-09-28 23:20:28 UTC
(In reply to Lisette Scheer from comment #6)
> I think that would be a good community discussion. Maybe the next General
> meeting?

I can never make the meetings but wouldn't hurt
Comment 8 Lucas Gass (lukeg) 2025-10-09 21:01:59 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 9 Lucas Gass (lukeg) 2025-10-09 22:40:48 UTC
kohadev-koha@kohadevbox:koha(main)$ prove -v /kohadevbox/koha/t/Makefile.t
/kohadevbox/koha/t/Makefile.t .. 
1..3
ok 1 - We should test something
not ok 2 - All directories should be mapped: SECURITY.md

#   Failed test 'All directories should be mapped: SECURITY.md'
#   at /kohadevbox/koha/t/Makefile.t line 53.
#          got: '1'
#     expected: '0'
ok 3 - no warnings
# Looks like you failed 1 test of 3.
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/3 subtests
Comment 10 Lucas Gass (lukeg) 2025-10-09 22:47:07 UTC
Created attachment 187710 [details] [review]
Bug 40527: Add SECURITY.md to ignored list in MakeFile.t
Comment 11 Lucas Gass (lukeg) 2025-10-09 22:47:58 UTC
follow-up pushed to main