Skip to content

Add organization-wide SECURITY.md and link it from the profile #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jplgarcia merged 3 commits into from
Oct 30, 2026
Merged

Add organization-wide SECURITY.md and link it from the profile #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
688000c
Add organization-wide SECURITY.md
jplgarcia Oct 30, 2026
a41f953
Link the security policy from the profile README
jplgarcia Oct 30, 2026
ac933c5
Use a relative link to SECURITY.md in the profile README
jplgarcia Oct 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
# Security Policy

This policy applies to the Cartesi repositories that do not have a `SECURITY.md` of their own.

## Supported Versions

Cartesi Rollups is under active development. Please check that the issue is present in the most recent
release of the affected repository before reporting it.

## Reporting a Vulnerability

**Please do not open a public issue, pull request or discussion for a security problem.**

Report it privately by email to `rollups@cartesi.foundation`. Include the affected
component and version, the impact, and steps to reproduce.

## What Happens Next

We review each report, decide how to handle it, and reply with the outcome. When a fix is
released and the issue affects users, we may describe it on the
[Audit Reports](https://docs.cartesi.io/get-started/audit-reports) page of the Cartesi documentation.

Please give us a reasonable time to fix an issue before you disclose it publicly.
1 change: 1 addition & 0 deletions profile/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ Cartesi is developed as an open-source public good, with infrastructure availabl
- [Sequencer](https://github.com/cartesi/sequencer): add optional low-latency soft confirmations and batch inputs for submission to the base chain.
- [Engineering map](ENGINEERING_MAP.md): find repositories, component status, and dependencies.
- [Developer community](https://discord.gg/cartesi): ask questions and discuss what you are building.
- [Security policy](../SECURITY.md): report a vulnerability privately.

Contributions are welcome through each repository's contribution guidelines.
Licenses vary by component: the Cartesi Machine uses LGPL-3.0; the on-chain Machine verifier, Dave, Rollups Contracts, Rollups Node, Sequencer, and the CLI use Apache-2.0.
Expand Down