1# The OpenBMC security vulnerability reporting process
2
3This describes the OpenBMC security vulnerability reporting process
4which is intended to give the project time to address security
5problems before public disclosure.
6
7The main pieces are:
8 - a procedure to privately report security vulnerabilities
9 - a security response team to address reported vulnerabilities
10 - the openbmc-security email address for the response team
11 - guidelines for security response team members
12
13The basic workflow is:
14 1. A community member reports a problem privately to the security
15    response team (and to the repository maintainers if known).
16 2. The responders (including the security response team, the
17    repository maintainers, and the problem submitter) work to
18    understand the problem.
19 3. The repository maintainer creates an OpenBMC security advisory
20    which explains the problem, its severity, and how to protect your
21    systems that were built on OpenBMC.
22 4. The responders privately engage community members to create
23    workarounds and fixes and to negotiate disclosure dates.
24 5. The OpenBMC security advisory is published along with any
25    accompanying CVEs.
26
27Note that the OpenBMC security response team is distinct from the
28OpenBMC security working group which remains completely open.
29
30The [How to privately report a security vulnerability](./how-to-report-a-security-vulnerability.md)
31web page explains how OpenBMC community members can report a security
32vulnerability and get a fix for it before public announcement of the
33vulnerability.
34
35The `openbmc-security at lists.ozlabs.org` email address is the primary
36communication vehicle between the person who reported the problem and
37the security response team, and the initial communication between the
38security response team members.
39
40The [Guidelines for security response team members](./obmc-security-response-team-guidelines.md)
41contain collected wisdom for the response team and community members
42who are working to fix the problem.
43