From 688000c64d5be62306341155c43006abbd9ef281 Mon Sep 17 00:00:00 2001 From: Joao Garcia Date: Fri, 30 Oct 2026 11:49:59 +0000 Subject: [PATCH 1/3] Add organization-wide SECURITY.md Co-Authored-By: Claude Sonnet 5.5 --- SECURITY.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..6a1aff3 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,23 @@ +# Security Policy + +This policy applies to the Cartesi repositories that do not have a `SECURITY.md` of their own. + +## Supported Versions + +Cartesi Rollups is under active development. Please check that the issue is present in the most recent +release of the affected repository before reporting it. + +## Reporting a Vulnerability + +**Please do not open a public issue, pull request or discussion for a security problem.** + +Report it privately by email to `rollups@cartesi.foundation`. Include the affected +component and version, the impact, and steps to reproduce. + +## What Happens Next + +We review each report, decide how to handle it, and reply with the outcome. When a fix is +released and the issue affects users, we may describe it on the +[Audit Reports](https://docs.cartesi.io/get-started/audit-reports) page of the Cartesi documentation. + +Please give us a reasonable time to fix an issue before you disclose it publicly. From a41f953b4d3b5916feb100c1163ce9cb23f127c6 Mon Sep 17 00:00:00 2001 From: Joao Garcia Date: Fri, 30 Oct 2026 13:48:44 +0000 Subject: [PATCH 2/3] Link the security policy from the profile README Co-Authored-By: Claude Sonnet 5.5 --- profile/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/profile/README.md b/profile/README.md index 5d39639..9afa77f 100644 --- a/profile/README.md +++ b/profile/README.md @@ -25,6 +25,7 @@ Cartesi is developed as an open-source public good, with infrastructure availabl - [Sequencer](https://github.com/cartesi/sequencer): add optional low-latency soft confirmations and batch inputs for submission to the base chain. - [Engineering map](ENGINEERING_MAP.md): find repositories, component status, and dependencies. - [Developer community](https://discord.gg/cartesi): ask questions and discuss what you are building. +- [Security policy](https://github.com/cartesi/.github/blob/main/SECURITY.md): report a vulnerability privately. Contributions are welcome through each repository's contribution guidelines. Licenses vary by component: the Cartesi Machine uses LGPL-3.0; the on-chain Machine verifier, Dave, Rollups Contracts, Rollups Node, Sequencer, and the CLI use Apache-2.0. From ac933c5d4d4795e7cd852ba366385d66bcd9e8d1 Mon Sep 17 00:00:00 2001 From: Joao Garcia Date: Fri, 30 Oct 2026 13:54:43 +0000 Subject: [PATCH 3/3] Use a relative link to SECURITY.md in the profile README Co-Authored-By: Claude Sonnet 5.5 --- profile/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/profile/README.md b/profile/README.md index 9afa77f..adcd7d4 100644 --- a/profile/README.md +++ b/profile/README.md @@ -25,7 +25,7 @@ Cartesi is developed as an open-source public good, with infrastructure availabl - [Sequencer](https://github.com/cartesi/sequencer): add optional low-latency soft confirmations and batch inputs for submission to the base chain. - [Engineering map](ENGINEERING_MAP.md): find repositories, component status, and dependencies. - [Developer community](https://discord.gg/cartesi): ask questions and discuss what you are building. -- [Security policy](https://github.com/cartesi/.github/blob/main/SECURITY.md): report a vulnerability privately. +- [Security policy](../SECURITY.md): report a vulnerability privately. Contributions are welcome through each repository's contribution guidelines. Licenses vary by component: the Cartesi Machine uses LGPL-3.0; the on-chain Machine verifier, Dave, Rollups Contracts, Rollups Node, Sequencer, and the CLI use Apache-2.0.