.. _disclosure:

==========================
Security disclosure policy
==========================

:email: security@saltstack.com
:gpg key ID: 4EA0793D
:gpg key fingerprint: ``8ABE 4EFC F0F4 B24B FF2A  AF90 D570 F2D3 4EA0 793D``

**gpg public key:**

.. code-block:: text

    -----BEGIN PGP PUBLIC KEY BLOCK-----

[encoded data, 6624 characters]
    fwPKmQ2cKnCBs5ASj1DkgUcz2c8DTUPVqg==
    =i1Tf
    -----END PGP PUBLIC KEY BLOCK-----

The SaltStack Security Team is available at security@saltstack.com for
security-related bug reports or questions.

We request the disclosure of any security-related bugs or issues be reported
non-publicly until such time as the issue can be resolved and a security-fix
release can be prepared. At that time we will release the fix and make a public
announcement with upgrade instructions and download locations.

Security response procedure
===========================

SaltStack takes security and the trust of our customers and users very
seriously. Our disclosure policy is intended to resolve security issues as
quickly and safely as is possible.

1.  A security report sent to security@saltstack.com is assigned to a team
    member. This person is the primary contact for questions and will
    coordinate the fix, release, and announcement.

2.  The reported issue is reproduced and confirmed. A list of affected projects
    and releases is made.

3.  Fixes are implemented for all affected projects and releases that are
    actively supported. Back-ports of the fix are made to any old releases that
    are actively supported.

4.  Packagers are notified via the `salt-packagers`_ mailing list that an issue
    was reported and resolved, and that an announcement is incoming.

5.  A pre-announcement is sent out to the `salt-announce`_ mailing list approximately
    a week before the CVE release. This announcement does not include details
    of the vulnerability. The pre-announcement will include the date the release
    will occur and the vulnerability rating.

6.  A new release is created and pushed to all affected repositories. The
    release documentation provides a full description of the issue, plus any
    upgrade instructions or other relevant details.

7.  An announcement is made to the `salt-users`_ and `salt-announce`_ mailing
    lists. The announcement contains a description of the issue and a link to
    the full release documentation and download locations.

.. _saltstack_security_announcements:

Receiving security announcements
================================

The following mailing lists, per the previous tasks identified in our response
procedure, will receive security-relevant notifications:

* `salt-packagers`_
* `salt-users`_
* `salt-announce`_

In addition to the mailing lists, SaltStack also provides the following resources:

* `SaltStack Security Announcements <https://www.saltstack.com/security-announcements/>`__ landing page
* `SaltStack Security RSS Feed <http://www.saltstack.com/feed/?post_type=security>`__
* `SaltStack Community Slack Workspace <http://saltstackcommunity.slack.com/>`__
