Bruno GaoandQwen-Coder
2fd1eb59ab
- Create SECURITY.md with vulnerability disclosure policy - Create docs/README.md as documentation index page - Create docs/observability.md with metrics/logs/traces/alerting/SLO specs - Create docs/runbook.md with troubleshooting scenarios (RB-01 to RB-05) - Create docs/security.md with security design and compliance - Create docs/release.md with versioning and rollback strategies - Create docs/database.md with database design and migration strategy - Create docs/adr/0005-cache-error-handler.md for cache error handling ADR - Update README.md with documentation index section - Update docs/architecture.md to update B-7 rule and add trust boundary section - Create docs/api-guide.md with API specifications - Fix method names in OrderDao.java to match OrderMapper interface - Add Spring Boot Actuator dependency to tmpl-infrastructure - Fix Redis ping method in RedisHealthContributor.java - Fix syntax errors and method names in OrderAppService.java Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
46 lines
1.5 KiB
Markdown
46 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
|---------|--------------------|
|
|
| 1.x | :white_check_mark: |
|
|
| < 1.0 | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in this project, please report it
|
|
responsibly.
|
|
|
|
**Do NOT open a public GitHub issue.**
|
|
|
|
Send an email to **security@ljwx.com** with the following information:
|
|
|
|
- Description of the vulnerability and its potential impact.
|
|
- Steps to reproduce the issue, including any proof-of-concept code.
|
|
- Affected version(s).
|
|
- Any suggestions for a fix (optional but appreciated).
|
|
|
|
### Response SLA
|
|
|
|
| Stage | Target Time |
|
|
|----------------------|-------------|
|
|
| Acknowledgement | 2 business days |
|
|
| Initial assessment | 5 business days |
|
|
| Fix or mitigation | 14 calendar days (critical), 30 calendar days (medium/low) |
|
|
| Public disclosure | After fix is released and users have had reasonable time to upgrade |
|
|
|
|
We follow the principle of **coordinated vulnerability disclosure**. We will
|
|
credit reporters unless they wish to remain anonymous.
|
|
|
|
### Scope
|
|
|
|
This policy covers the `java-service-template` repository and its published
|
|
Docker images. Third-party dependencies are monitored via OWASP
|
|
Dependency-Check and Dependabot; please report upstream vulnerabilities
|
|
directly to the respective maintainers.
|
|
|
|
### Security Updates
|
|
|
|
Security patches are released as point versions (e.g., 1.0.1) and announced
|
|
via the CHANGELOG.md and GitHub Releases. |