22 lines
1.3 KiB
Markdown
22 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We're extremely grateful for security researchers and users who report vulnerabilities they discovered in DataLens. All reports are thoroughly investigated.
|
|
|
|
To report a potential vulnerability in DataLens please email details to [datalens-security@yandex-team.ru](mailto:datalens-security@yandex-team.ru).
|
|
|
|
### When Should I Report a Vulnerability?
|
|
|
|
- You think you discovered a potential security vulnerability in DataLens
|
|
- You are unsure how a vulnerability affects DataLens
|
|
|
|
## Security Vulnerability Response
|
|
|
|
Each report is acknowledged and analyzed by DataLens maintainers within 5 working days.
|
|
We will keep the reporter informed about the issue progress.
|
|
|
|
## Public Disclosure Timing
|
|
|
|
A public disclosure date is negotiated by DataLens maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a mitigation is available for DataLens users. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days.
|