From 5dbabed7a96c61937267a434e0f150c6213faed6 Mon Sep 17 00:00:00 2001 From: Brandon Philips Date: Tue, 29 Nov 2016 12:27:56 -0800 Subject: [PATCH] docs: create /security endpoint Create an easy to remember and locate URL for security disclosure process. This URL will need to be placed in lots of templates and tools so make it easy. --- docs/reporting-security-issues.md | 22 +--------------------- security.md | 28 ++++++++++++++++++++++++++++ 2 files changed, 29 insertions(+), 21 deletions(-) create mode 100644 security.md diff --git a/docs/reporting-security-issues.md b/docs/reporting-security-issues.md index da4da20b3c..28e40cea9c 100644 --- a/docs/reporting-security-issues.md +++ b/docs/reporting-security-issues.md @@ -5,24 +5,4 @@ assignees: --- -If you believe you have discovered a vulnerability or a have a security incident to report, please follow the steps below. This applies to Kubernetes releases v1.0 or later. - -To watch for security and major API announcements, please join our [kubernetes-announce](https://groups.google.com/forum/#!forum/kubernetes-announce) group. - -## Reporting a security issue - -To report an issue, please: - -- Submit a bug report [here](http://goo.gl/vulnz). - - Select 'I want to report a technical security bug in a Google product (SQLi, XSS, etc.).'? - - Select 'Other'? as the Application Type. -- Under reproduction steps, please additionally include - - the words "Kubernetes Security issue" - - Description of the issue - - Kubernetes release (e.g. output of `kubectl version` command, which includes server version.) - - Environment setup (e.g. which "Getting Started Guide" you followed, if any; what node operating system used; what service or software creates your virtual machines, if any) - -An online submission will have the fastest response; however, if you prefer email, please send mail to security@google.com. If you feel the need, please use the [PGP public key](https://services.google.com/corporate/publickey.txt) to encrypt communications. - - - +This document has moved to [http://kubernetes.io/security](http://kubernetes.io/security). diff --git a/security.md b/security.md new file mode 100644 index 0000000000..da4da20b3c --- /dev/null +++ b/security.md @@ -0,0 +1,28 @@ +--- +assignees: +- eparis +- erictune + +--- + +If you believe you have discovered a vulnerability or a have a security incident to report, please follow the steps below. This applies to Kubernetes releases v1.0 or later. + +To watch for security and major API announcements, please join our [kubernetes-announce](https://groups.google.com/forum/#!forum/kubernetes-announce) group. + +## Reporting a security issue + +To report an issue, please: + +- Submit a bug report [here](http://goo.gl/vulnz). + - Select 'I want to report a technical security bug in a Google product (SQLi, XSS, etc.).'? + - Select 'Other'? as the Application Type. +- Under reproduction steps, please additionally include + - the words "Kubernetes Security issue" + - Description of the issue + - Kubernetes release (e.g. output of `kubectl version` command, which includes server version.) + - Environment setup (e.g. which "Getting Started Guide" you followed, if any; what node operating system used; what service or software creates your virtual machines, if any) + +An online submission will have the fastest response; however, if you prefer email, please send mail to security@google.com. If you feel the need, please use the [PGP public key](https://services.google.com/corporate/publickey.txt) to encrypt communications. + + +