From 55f721e235274f37856ba97137b26445e75a557d Mon Sep 17 00:00:00 2001 From: Mariano Tucat Date: Fri, 31 Oct 2025 00:39:51 -0300 Subject: [PATCH 1/5] Add SECURITY.md placeholder --- SECURITY.md | 134 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 134 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..f1deef1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,134 @@ +# Security Policy + +## Supported Versions + +We release patches for security vulnerabilities in the following versions: + +| Version | Supported | +| ------- | ------------------ | +| 1.x.x | :white_check_mark: | +| < 1.0 | :x: | + +> **Note:** Please update this table to reflect the actual versions you support. + +--- + +## Reporting a Vulnerability + +We take the security of our software seriously. If you believe you have found a security vulnerability, please report it to us as described below. + +### How to Report + +**Please do not report security vulnerabilities through public GitHub issues.** + +Instead, please email us at **[security@skedgo.com](mailto:security@skedgo.com)**. + +You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message. + +### What to Include + +Please include the following information in your report: + +- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.) +- Full paths of source file(s) related to the manifestation of the issue +- The location of the affected source code (tag/branch/commit or direct URL) +- Any special configuration required to reproduce the issue +- Step-by-step instructions to reproduce the issue +- Proof-of-concept or exploit code (if possible) +- Impact of the issue, including how an attacker might exploit it + +This information will help us triage your report more quickly. + +### What to Expect + +After you submit a report, we will: + +1. **Acknowledge** your email within 48 hours +2. **Investigate** the issue and confirm the vulnerability +3. **Keep you informed** of our progress toward a fix +4. **Release** a security patch as appropriate +5. **Credit** you in our release notes (if you wish to be named) + +--- + +## Security Best Practices for Contributors + +If you're contributing to this project, please follow these security guidelines: + +### Code Review +- All code changes must go through Pull Requests +- PRs require approval from at least one maintainer before merging +- No direct commits to `main` or protected branches + +### Dependencies +- Keep dependencies up to date +- Review dependency changes for known vulnerabilities +- Use automated tools like Dependabot to monitor security issues + +### Secrets Management +- **Never** commit credentials, API keys, tokens, or other secrets +- Use environment variables or secure secret management systems +- Review commits for accidentally included secrets before pushing + +### Secure Coding +- Follow [OWASP Top 10](https://owasp.org/www-project-top-ten/) best practices +- Validate and sanitize all user inputs +- Use parameterized queries to prevent SQL injection +- Implement proper authentication and authorization +- Use HTTPS/TLS for all network communications + +--- + +## Security Features + +This project includes the following security measures: + +- **Dependabot alerts** enabled for vulnerable dependencies +- **Secret scanning** enabled to prevent credential leaks +- **Code review** required for all changes +- **Branch protection** rules enforced on main branches + +--- + +## Disclosure Policy + +We follow a **coordinated disclosure** approach: + +1. Security issues are privately investigated and patched +2. A security advisory is prepared but not published +3. We notify relevant parties (e.g., major users, downstream projects) +4. A patch release is made available +5. The security advisory is published after users have had time to update + +We aim to complete this process within 90 days of the initial report, though complex issues may take longer. + +--- + +## Security Update Policy + +Security updates are released as: +- **Patch versions** (x.x.X) for currently supported versions +- **Security advisories** published on our GitHub Security Advisories page +- **Release notes** clearly marking security-related changes + +--- + +## Additional Resources + +- [OWASP Top 10](https://owasp.org/www-project-top-ten/) +- [CWE Top 25 Most Dangerous Software Weaknesses](https://cwe.mitre.org/top25/) +- [GitHub Security Best Practices](https://docs.github.com/en/code-security) + +--- + +## Contact + +For general security questions or concerns, please contact: +- **Email:** [security@skedgo.com](mailto:security@skedgo.com) + +--- + +> **Last Updated:** {{ DATE }} +> **Version:** 1.0 +> +> This security policy is maintained by the repository maintainers and reviewed regularly. From 37003279dcb4979a941034d58c76499e128da798 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adrian=20Sch=C3=B6nig?= Date: Fri, 14 Nov 2025 17:12:41 +1100 Subject: [PATCH 2/5] Revise SECURITY.md for supported versions and date Updated the security policy with supported versions and last updated date. --- SECURITY.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f1deef1..0802897 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,10 +6,8 @@ We release patches for security vulnerabilities in the following versions: | Version | Supported | | ------- | ------------------ | -| 1.x.x | :white_check_mark: | -| < 1.0 | :x: | - -> **Note:** Please update this table to reflect the actual versions you support. +| >= 0.2 | :white_check_mark: | +| < 0.2 | :x: | --- @@ -128,7 +126,7 @@ For general security questions or concerns, please contact: --- -> **Last Updated:** {{ DATE }} +> **Last Updated:** 14 Nov 2025 > **Version:** 1.0 > > This security policy is maintained by the repository maintainers and reviewed regularly. From e2b316799685872755f901d9582f3368db38ce64 Mon Sep 17 00:00:00 2001 From: Adrian Schoenig Date: Sun, 16 Nov 2025 19:09:36 +1100 Subject: [PATCH 3/5] Update GHA --- .github/workflows/build.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 68b08b9..35a5ae5 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,20 +5,20 @@ on: branches: [ main ] pull_request: branches: [ main ] - + jobs: macos: - runs-on: macos-12 # macos-latest is still 10.15, which we don't support + runs-on: macos-latest steps: - uses: maxim-lobanov/setup-xcode@v1 with: xcode-version: latest-stable - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Build & Test - run: xcodebuild test -scheme 'GeoMonitor' -sdk iphonesimulator -destination 'platform=iOS Simulator,name=iPhone 14' -resultBundlePath TestResults + run: xcodebuild test -scheme 'GeoMonitor' -sdk iphonesimulator -destination 'platform=iOS Simulator,name=iPhone 17' -resultBundlePath TestResults - uses: kishikawakatsumi/xcresulttool@v1.7.0 with: path: TestResults.xcresult if: success() || failure() # ^ This is important because the action will be run - # even if the test fails in the previous step. \ No newline at end of file + # even if the test fails in the previous step. From 2fba29120dc80e2b94ffe5950e3c80935cef4614 Mon Sep 17 00:00:00 2001 From: Adrian Schoenig Date: Sun, 16 Nov 2025 19:13:00 +1100 Subject: [PATCH 4/5] Wind back Xcode version for now --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 35a5ae5..8a0f34c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,7 +12,7 @@ jobs: steps: - uses: maxim-lobanov/setup-xcode@v1 with: - xcode-version: latest-stable + xcode-version: 26.0.1 # 26.1 has issues on GHA - uses: actions/checkout@v4 - name: Build & Test run: xcodebuild test -scheme 'GeoMonitor' -sdk iphonesimulator -destination 'platform=iOS Simulator,name=iPhone 17' -resultBundlePath TestResults From b4285412f3457fdbc3d177ee23b5c01c714396ec Mon Sep 17 00:00:00 2001 From: Adrian Schoenig Date: Sun, 16 Nov 2025 19:17:15 +1100 Subject: [PATCH 5/5] Use xcbeautify rather than xcresulttool --- .github/workflows/build.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8a0f34c..514cca5 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,13 +12,7 @@ jobs: steps: - uses: maxim-lobanov/setup-xcode@v1 with: - xcode-version: 26.0.1 # 26.1 has issues on GHA + xcode-version: 26.0.1 # 26.1 is missing simulators on GHA as of November 2025 - uses: actions/checkout@v4 - name: Build & Test - run: xcodebuild test -scheme 'GeoMonitor' -sdk iphonesimulator -destination 'platform=iOS Simulator,name=iPhone 17' -resultBundlePath TestResults - - uses: kishikawakatsumi/xcresulttool@v1.7.0 - with: - path: TestResults.xcresult - if: success() || failure() - # ^ This is important because the action will be run - # even if the test fails in the previous step. + run: set -o pipefail && xcodebuild test -scheme 'GeoMonitor' -sdk iphonesimulator -destination 'platform=iOS Simulator,name=iPhone 17' | xcbeautify