You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Security issues are treated very seriously and will, by default,
4
-
takes precedence over other considerations including usability, performance,
5
-
etc... Best effort will be used to mitigate side effects of a security
6
-
change, but PowerShell must be secure by default.
3
+
## Security
7
4
8
-
## Reporting a security vulnerability
5
+
Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin) and [PowerShell](https://github.com/PowerShell).
9
6
10
-
If you believe that there is a security vulnerability in PowerShell,
11
-
it **must** be reported using [https://aka.ms/secure-at](https://aka.ms/secure-at) to allow for [Coordinated Vulnerability Disclosure](https://technet.microsoft.com/security/dn467923).
12
-
**Only** file an issue, if [MSRC](https://www.microsoft.com/en-us/msrc/faqs-report-an-issue?rtc=1) has confirmed filing an issue is appropriate.
7
+
If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/security.md/definition), please report it to us as described below.
8
+
9
+
## Reporting Security Issues
10
+
11
+
**Please do not report security vulnerabilities through public GitHub issues.**
12
+
13
+
Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/security.md/msrc/create-report).
14
+
15
+
If you prefer to submit without logging in, send email to [[email protected]](mailto:[email protected]). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/security.md/msrc/pgp).
16
+
17
+
You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc).
18
+
19
+
Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
20
+
21
+
* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
22
+
* Full paths of source file(s) related to the manifestation of the issue
23
+
* The location of the affected source code (tag/branch/commit or direct URL)
24
+
* Any special configuration required to reproduce the issue
25
+
* Step-by-step instructions to reproduce the issue
26
+
* Proof-of-concept or exploit code (if possible)
27
+
* Impact of the issue, including how an attacker might exploit the issue
28
+
29
+
This information will help us triage your report more quickly.
30
+
31
+
If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/security.md/msrc/bounty) page for more details about our active programs.
32
+
33
+
## Preferred Languages
34
+
35
+
We prefer all communications to be in English.
36
+
37
+
## Policy
38
+
39
+
Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/security.md/cvd).
This project has adopted the [Microsoft Open Source Code of Conduct][conduct-code].
4
-
For more information see the [Code of Conduct FAQ][conduct-FAQ] or contact [[email protected]][conduct-email] with any additional questions or comments.
3
+
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
This project has adopted the [Microsoft Open Source Code of Conduct][conduct-code].
145
-
For more information, see the [Code of Conduct FAQ][conduct-FAQ] or contact [[email protected]][conduct-email] with any additional questions or comments.
144
+
Please see our [Code of Conduct](CODE_OF_CONDUCT.md) before participating in this project.
Copy file name to clipboardexpand all lines: docs/community/governance.md
+19-4
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@
6
6
approving [RFCs][RFC-repo], and approving new maintainers/committee members
7
7
*[**Repository maintainer**](#repository-maintainers): An individual responsible for merging pull requests (PRs) into `master` when all requirements are met (code review, tests, docs, and RFC approval as applicable).
8
8
Repository Maintainers are the only people with write permissions for the `master` branch.
9
-
*[**Working Groups (WGs)**](#working-groups-(wgs)) are collections of contributors responsible for
9
+
*[**Working Groups (WGs)**](#working-groups) are collections of contributors responsible for
10
10
providing expertise on a specific area of PowerShell in order to help establish consensus within
11
11
the community and Committee.
12
12
***Corporation**: The Corporation owns the PowerShell repository and, under extreme circumstances,
@@ -58,15 +58,16 @@ If any Committee Members feels like this behavior is large enough to warrant an
58
58
59
59
As a PowerShell Committee Member:
60
60
61
+
1.**DO** enforce the [Code of Conduct][coc] by taking reports of abuse and violations to the committee for resolution
61
62
1.**DO** reply to issues and pull requests with design opinions
62
63
(this could include offering support for good work or exciting new features)
63
64
1.**DO** encourage healthy discussion about the direction of PowerShell
64
65
1.**DO** raise "red flags" on PRs that haven't followed the proper RFC process when applicable
65
66
1.**DO** contribute to documentation and best practices
66
-
1.**DO** maintain a presence in the PowerShell community outside of GitHub (Twitter, blogs, StackOverflow, Reddit, Hacker News, etc.)
67
+
1.**DO** maintain a presence in the PowerShell community outside of GitHub (Twitter, blogs, Stack Overflow, Reddit, Hacker News, etc.)
67
68
1.**DO** heavily incorporate community feedback into the weight of your decisions
68
69
1.**DO** be polite and respectful to a wide variety of opinions and perspectives
69
-
1.**DO** make sure contributors are following the [contributor guidelines](../../.github/CONTRIBUTING.md)
70
+
1.**DO** make sure contributors are following the [contributing guidelines](../../.github/CONTRIBUTING.md)
70
71
71
72
1.**DON'T** constantly raise "red flags" for unimportant or minor problems to the point that the progress of the project is being slowed
72
73
1.**DON'T** offer up your opinions as the absolute opinion of the PowerShell Committee.
@@ -82,14 +83,27 @@ At any point in time, a Committee Member can nominate a strong community member
82
83
Nominations should be submitted in the form of [RFCs][RFC-repo] detailing why that individual is qualified and how they will contribute.
83
84
After the RFC has been discussed, a unanimous vote will be required for the new Committee Member to be confirmed.
84
85
86
+
### PowerShell Committee Code of Conduct Enforcement
87
+
88
+
As stated in the [contributing guidelines](../../.github/CONTRIBUTING.md#code-of-conduct-enforcement):
89
+
90
+
Reports of abuse will be reviewed by the PowerShell Committee and if it has been determined that violations of the
91
+
[Code of Conduct][coc] has occurred, then a temporary ban may be imposed.
92
+
The duration of the temporary ban will depend on the impact and/or severity of the infraction.
93
+
This can vary from 1 day, a few days, a week, and up to 30 days.
94
+
Repeat offenses may result in a permanent ban from the PowerShell org.
95
+
96
+
Microsoft employees on the PowerShell committee should review the available support at
Repository Maintainers are trusted stewards of the PowerShell community/repository responsible for maintaining consistency and quality of PowerShell code.
88
102
One of their primary responsibilities is merging pull requests after all requirements have been fulfilled.
89
103
90
104
For more information on Repository Maintainers--their responsibilities, who they are, and how one becomes a Maintainer--see the [README for Repository Maintainers][maintainers].
91
105
92
-
## Working Groups (WGs)
106
+
## Working Groups
93
107
94
108
[Working Groups (WGs)][wg] are collections of contributors with knowledge of specific components or
95
109
technologies in the PowerShell domain.
@@ -143,6 +157,7 @@ See our [Pull Request Process][pull-request-process]
-[Becoming a Repository Maintainer](#becoming-a-repository-maintainer)
20
19
21
20
## Current Repository Maintainers
@@ -33,7 +32,7 @@ They have [write access](https://docs.github.com/en/free-pro-team@latest/github/
33
32
34
33
<!-- please keep in alphabetical order -->
35
34
36
-
- Andy Schwartzmeyer ([andschwa](https://github.com/andschwa))
35
+
- Andy Jordan ([andyleejordan](https://github.com/andyleejordan))
37
36
- Jason Shirk ([lzybkr](https://github.com/lzybkr))
38
37
- Mike Richmond ([mirichmo](https://github.com/mirichmo))
39
38
- Sergei Vorobev ([vors](https://github.com/vors))
@@ -44,6 +43,7 @@ Repository Maintainers enable rapid contributions while maintaining a high level
44
43
45
44
If you are a Repository Maintainer, you:
46
45
46
+
1.**MUST** abide by the [Code of Conduct](../../CODE_OF_CONDUCT.md) and report suspected violations to the [PowerShell Committee][ps-committee]
47
47
1.**MUST** ensure that each contributor has signed a valid Microsoft Contributor License Agreement (CLA)
48
48
1.**MUST** verify compliance with any third party code license terms (e.g., requiring attribution, etc.) if the contribution contains third party code.
49
49
1.**MUST** make sure that [any change requiring approval from the PowerShell Committee](../community/governance.md#changes-that-require-an-rfc) has gone through the proper [RFC][RFC-repo] or approval process
@@ -96,10 +96,11 @@ At any point in time, the existing Repository Maintainers can unanimously nomina
96
96
Nominations are brought to the PowerShell Committee to understand the reasons and justification.
97
97
A simple majority of the PowerShell Committee is required to veto the nomination.
98
98
When a nominee has been approved, a PR will be submitted by a current Maintainer to update this document to add the nominee's name to
99
-
the [Current Repository Maintainers](#Current-Repository-Maintainers) with justification as the description of the PR to serve as the public announcement.
99
+
the [Current Repository Maintainers](#current-repository-maintainers) with justification as the description of the PR to serve as the public announcement.
0 commit comments