From 77c1614de1643304a172271c82a3daa2f43a1919 Mon Sep 17 00:00:00 2001 From: Eric Bariaux <375613+ebariaux@users.noreply.github.com> Date: Tue, 16 Jun 2026 14:56:05 +0200 Subject: [PATCH] Document security advisory process --- ...y-management-and-coordinated-disclosure.md | 25 ++++++++++++++++--- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/docs/vulnerability-management-and-coordinated-disclosure.md b/docs/vulnerability-management-and-coordinated-disclosure.md index 4fc3842..f49748f 100644 --- a/docs/vulnerability-management-and-coordinated-disclosure.md +++ b/docs/vulnerability-management-and-coordinated-disclosure.md @@ -28,10 +28,27 @@ Reported vulnerabilities are assessed and addressed in a coordinated manner befo ## **6.4 Security Advisory Process** {#6.4-security-advisory-process-–-placeholder} -:::note -This is work in progress and not fully implemented yet, as OpenRemote, we are working on this subject and will publish an update soon. -::: - When security issues affecting OpenRemote software are confirmed, a security advisory may be issued to inform users about the vulnerability and recommended mitigation actions. Security advisories are reviewed and approved internally before publication and are archived for reference. + +People can submit potential vulnerabilities at [Security Advisories](https://github.com/openremote/openremote/security/advisories). +Submitted advisories are reviewed by the quality officer or its backups in a timely manner. +They decide to accept or reject them. If accepted, a CVE is requested from GitHub. + +Once accepted, a fix can be developed in a private fork, created from the advisory page. +This is a private repository with limited access and limited functionality. It does not support LFS and does not run any CI/CD actions. + +As it does not support LFS, when cloning, use `GIT_LFS_SKIP_SMUDGE=1 git clone https://…` to avoid any problem. +If you’re using git worktree, working with a private fork requires you to use a separate remote, this can become quite confusing; working on a fork in a completely separate clone is often easier and less error-prone. +Although work on the fork can still be performed in a branch, it does not bring much value. +Once a PR is created, it will not appear in the normal PR list, it must be accessed via the advisory page. +Similarly, it must be merged from the advisory page and by a person from the “Product Owners” group. + +For the merge feature to become available, those persons must be able to bypass the branch policies. +This means that “Product Owners” have been added as able to bypass any defined rulesets (as of this writing, there’s only one, “Copilot review for default branch”). +In addition, for the merge to succeed, the check that a valid CI/CD has run must be bypassed. +This is done by temporarily unchecking the "Do not allow bypassing the above settings" option in the branch protection rules configuration. +Don’t forget to re-enable it once the merge has been done. + +Once a release including the fix has been made publicly available, publish the advisory. \ No newline at end of file