A security policy for a theme #

This page is for designers publishing a theme. Themes contain code: templates that print user input, scripts, sometimes PHP. A vulnerability report needs a private path to you, or it ends up as a public issue that helps attackers first.

The model: Exponential's own policy #

The SECURITY.md at the root of the Exponential repository has three parts:

1. Supported versions: which line gets fixes, and that a published tag is never changed; a fix arrives as the next release.
2. Reporting: report privately by email, not in the public issue tracker, with a stated first-response time.
3. What to include: the version, the PHP version, the server engine and database, what an attacker can do, the steps to reproduce, and no passwords, secrets or personal data.

It ends with what the reporter is told and when.

Step by step #

1. Create SECURITY.md at the root of the theme:

   # Security Policy
   
   ## Supported versions
   
   The newest 1.0.x release gets security fixes. A published tag is never changed: a fix arrives as the
   next release.
   
   ## Reporting a vulnerability
   
   Please report security issues privately to <your security address>, not in the public issues.
   Include the theme version, the Exponential and PHP versions, what an attacker can do and how to
   reproduce it. Leave out passwords and personal data.
   
   You will get an answer within <a time you can keep>.

2. Use an address that more than one person reads, if you can.

3. On GitHub you can also enable private vulnerability reporting for the repository (Settings > Security), which gives reporters a private form.

4. Link SECURITY.md from the README's support section.

Related pages #

• Handling security reports
• Publishing a security release
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.