Bruno GaoandQwen-Coder
2fd1eb59ab
- Create SECURITY.md with vulnerability disclosure policy - Create docs/README.md as documentation index page - Create docs/observability.md with metrics/logs/traces/alerting/SLO specs - Create docs/runbook.md with troubleshooting scenarios (RB-01 to RB-05) - Create docs/security.md with security design and compliance - Create docs/release.md with versioning and rollback strategies - Create docs/database.md with database design and migration strategy - Create docs/adr/0005-cache-error-handler.md for cache error handling ADR - Update README.md with documentation index section - Update docs/architecture.md to update B-7 rule and add trust boundary section - Create docs/api-guide.md with API specifications - Fix method names in OrderDao.java to match OrderMapper interface - Add Spring Boot Actuator dependency to tmpl-infrastructure - Fix Redis ping method in RedisHealthContributor.java - Fix syntax errors and method names in OrderAppService.java Co-authored-by: Qwen-Coder <[email protected]>
1.5 KiB
1.5 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| 1.x | ✅ |
| < 1.0 | ❌ |
Reporting a Vulnerability
If you discover a security vulnerability in this project, please report it responsibly.
Do NOT open a public GitHub issue.
Send an email to [email protected] with the following information:
- Description of the vulnerability and its potential impact.
- Steps to reproduce the issue, including any proof-of-concept code.
- Affected version(s).
- Any suggestions for a fix (optional but appreciated).
Response SLA
| Stage | Target Time |
|---|---|
| Acknowledgement | 2 business days |
| Initial assessment | 5 business days |
| Fix or mitigation | 14 calendar days (critical), 30 calendar days (medium/low) |
| Public disclosure | After fix is released and users have had reasonable time to upgrade |
We follow the principle of coordinated vulnerability disclosure. We will credit reporters unless they wish to remain anonymous.
Scope
This policy covers the java-service-template repository and its published
Docker images. Third-party dependencies are monitored via OWASP
Dependency-Check and Dependabot; please report upstream vulnerabilities
directly to the respective maintainers.
Security Updates
Security patches are released as point versions (e.g., 1.0.1) and announced via the CHANGELOG.md and GitHub Releases.