Issue Response Plan

This document outlines the procedure for dealing with any security issues the arise related to WendyOS and its associated tools and libraries.

Communication

All communication throughout this process, except for public announcements should happen exclusively through private channels. Not through public issues, PRs or public Discord Channels.

Use the private Github Security Advisory thread for communication with the reporter.

Response Process

Triage

Acknowledge receipt of report within 5 working days.

Read the report and validate vulnerability exists. If a PoC (Proof of Concept) is provided, verify it demonstrates the vulnerability.

Determine whether the vulnerability is in WendyOS, if not report upstream to relevant parties.

Scope

Identify the release of the library where this vulnerability was introduced.

Determine the severity/impact of the issue.

• Does the vulnerability expose confidential data, provide potential for denial of service attacks.
• Ease of replication: does it require precise timing, a significant number of steps, or a specific configuration.
• Is the vulnerability actively being exploited?
• Use the CVSS 4.0 base score as a guide.

Supply-chain and CI/CD incidents are always treated as Critical regardless of CVSS.

Mitigate

1. Use a private repo, or private pull request via GitHub advisory reporting to generate a patch.
2. Ask the reporter to verify patch.
3. Alert important and trusted adopters.
4. Prepare advisory
   • Title: {description}
   • Summary: Summary of vulnerability, severity.
   • Details: More detailed description of vulnerability.
   • Impact: How does this issue impact users of WendyOS.
   • Mitigations: Are there ways to mitigate against this issue without updating.
   • Timeline: When reported, patch written, CVE request, received and published.
   • Patches: Details of patched versions and patch.
   • Credit: Add credit to reporter
   • Select CWE.
5. Request CVE
6. We aim to resolve any issue within 30 days, but this may not always be possible.

Remediation and Disclosure

• Merge pull request and release versions of affected library with fix included. Security fixes are only applied to the latest stable releases of WendyOS. End users will be required to upgrade to latest once a release is made.
• Release CVE advisory.

Learn

• How was the vulnerability introduced?
• What could we have done to prevent it?
• Is there anything we can to ensure it doesn't happen again.
• What did we do well during the process?
• What could be improved in the process?