docs: Add a security policy (#6692)

larrysingleton007 · web-flow · commit e8edab5c002f · 2026-08-06T10:30:03.000+05:30
* docs: Add a security policy The repository has no SECURITY.md in any location, including the org-level .github repo, and neither the README nor the contributing guide mentions vulnerability reporting. Private vulnerability reporting is enabled and in active use, but with no policy file GitHub only surfaces it on the Security tab, so a reporter has to already know to look there. Issue #3684 shows the cost: a researcher asked how to disclose privately in July 2023, was pointed at Slack, and waited seven months for a contact address which then bounced. Disclosure completed only via a maintainer's personal email, and the gap itself was never closed. Adds a policy routing to the advisory form, states plainly that vulnerabilities must not go in issues, PRs, or Slack, and points the contributing guide's getting-started step at it, since that step currently sends everything to an issue or draft PR. Claims no response-time commitment and lists no email address: the maintainers can add those if they want them. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * docs: Add report quality requirements to the security policy Adds the three points ntkathole asked for in review: a duplicate check against published advisories before reporting, explicit report requirements (affected version, proof of concept or reproduction steps, actual impact), and a statement that unverified bulk, automated or AI-generated submissions may be closed without further response. Folded into the existing reporting section rather than appended as new sections, since the previous text already asked for reproduction detail and the advisories link already existed at the bottom. Also notes why raw scanner output alone is not enough: it does not establish that the issue is reachable in Feast. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> --------- Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,30 @@
+# Security Policy
+
+The Feast community takes security bugs seriously, and we appreciate the effort it takes to find and report them. We follow [GitHub's coordinated disclosure process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/about-coordinated-disclosure-of-security-vulnerabilities) so that a fix can be prepared before details become public.
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately through GitHub, using **[Report a vulnerability](https://github.com/feast-dev/feast/security/advisories/new)** on this repository's Security tab. Only the maintainers can see the report, and you will be credited on the published advisory if you would like to be.
+
+Before reporting, please check the [published advisories](https://github.com/feast-dev/feast/security/advisories) to confirm the issue has not already been addressed.
+
+A report needs to show a clear, reproducible security impact. Please include:
+
+- the affected version or commit, and the configuration involved
+- a proof of concept, or steps that reproduce the issue
+- the actual impact, rather than a theoretical concern
+
+Raw scanner or dependency-audit output does not meet that bar on its own, since it does not establish that the issue is reachable in Feast. Reports that have not been manually verified against Feast, including bulk, automated, or AI-generated submissions, may be closed without further response.
+
+> [!WARNING]
+> Do not open a public GitHub issue, pull request, or Slack message for a security vulnerability. Those are visible to everyone and disclose the problem before a fix exists.
+
+For anything that is not a vulnerability, including hardening suggestions and questions about how Feast's authentication and authorization work, a normal [GitHub issue](https://github.com/feast-dev/feast/issues) is the right place.
+
+## Supported versions
+
+Security fixes are applied to the latest release. Feast releases roughly monthly and offers best-effort community support, as described in the [versioning policy](docs/project/versioning-policy.md); there is no long-term support branch, so upgrading to the current release is the supported way to receive a fix.
+
+## Published advisories
+
+Past advisories for this project are listed under [Security advisories](https://github.com/feast-dev/feast/security/advisories).
diff --git a/docs/project/contributing.md b/docs/project/contributing.md
@@ -5,6 +5,8 @@ After familiarizing yourself with the documentation, the simplest way to get sta
 1. Setup your developer environment by following [development guide](development-guide.md). 
 2. Either create a [GitHub issue](https://github.com/feast-dev/feast/issues) or make a draft PR (following [development guide](development-guide.md)) to get the ball rolling!
 
+> **Reporting a security vulnerability?** Do not open an issue or PR. Report it privately through [GitHub's advisory form](https://github.com/feast-dev/feast/security/advisories/new); see the [security policy](https://github.com/feast-dev/feast/blob/master/SECURITY.md).
+
 ## Decision making process
 *See [governance](../../community/governance.md) for more details here*
 
