aboutsummaryrefslogtreecommitdiffhomepage
path: root/SECURITY.md
diff options
context:
space:
mode:
authorRigel Kent <sendmemail@rigelk.eu>2018-09-18 11:18:51 +0200
committerRigel Kent <sendmemail@rigelk.eu>2018-09-18 11:18:51 +0200
commitdf182b373fc49f20188d531494e1bff1a9ad247e (patch)
tree5839325dc1c1fa196a87f46ff7c4ffac707bab0b /SECURITY.md
parentd5931e623320d0851a19e1001e90c7d8138d7a20 (diff)
downloadPeerTube-df182b373fc49f20188d531494e1bff1a9ad247e.tar.gz
PeerTube-df182b373fc49f20188d531494e1bff1a9ad247e.tar.zst
PeerTube-df182b373fc49f20188d531494e1bff1a9ad247e.zip
normalize robot.txt and specify test servers as scope of security audits
Diffstat (limited to 'SECURITY.md')
-rw-r--r--SECURITY.md2
1 files changed, 1 insertions, 1 deletions
diff --git a/SECURITY.md b/SECURITY.md
index 37ed19246..5c668a2a3 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -30,7 +30,7 @@ To encourage vulnerability research and to avoid any confusion between good-fait
30- Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience. 30- Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience.
31- Use only the Official Channels to discuss vulnerability information with us. 31- Use only the Official Channels to discuss vulnerability information with us.
32- Keep the details of any discovered vulnerabilities confidential until they are fixed, according to the Disclosure Terms in this policy. 32- Keep the details of any discovered vulnerabilities confidential until they are fixed, according to the Disclosure Terms in this policy.
33- Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope. 33- Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope. Systems currently considered in-scope are the official demonstration/test servers provided by the PeerTube development team.
34- If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information. 34- If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information.
35- You should only interact with test accounts you own or with explicit permission from the account holder. 35- You should only interact with test accounts you own or with explicit permission from the account holder.
36- Do not engage in extortion. 36- Do not engage in extortion.