Note: This security policy — and the NeoNephos Security Guidelines it references — are currently a work in progress and have not yet been officially released. The document is based on an in-progress template, and both its contents and the process described here may change once the guidelines are finalized.
If you discover a security vulnerability in Luigi, please report it responsibly through one of the channels below. Do not open a public issue for security vulnerabilities.
To help us assess and address the vulnerability efficiently, please include:
- Affected component(s) and version(s)
- Steps to reproduce the vulnerability
- Impact assessment — what an attacker could achieve
- Whether the vulnerability is already publicly known
- Any suggested fix or mitigation (optional)
Please use GitHub's built-in private vulnerability reporting:
- Navigate to the Security tab of this repository.
- Click Report a vulnerability.
- Fill in the details and submit.
Direct link: Report a vulnerability
For more information, see Privately reporting a security vulnerability.
If you are unable to use GitHub's private vulnerability reporting, you may report vulnerabilities via email to luigi-security@lists.neonephos.org.
The following maintainers are responsible for handling vulnerability reports:
| Name | Handle | Role |
|---|---|---|
| Johannes Doberer | @johannesdoberer | Security Officer |
| Version | Supported |
|---|---|
| 2.x | Yes |
| < 2.0 | No |
This project follows the NeoNephos Security Guidelines for vulnerability handling. In summary:
- Initial response: We will respond to your report within 14 calendar days of receipt, in line with the OpenSSF Best Practices requirement.
- Embargo: Vulnerability details will remain confidential for up to 90 days from report receipt while a fix is developed, consistent with the Google Project Zero disclosure policy.
- Disclosure: Once a fix is available (or the embargo expires), we will publish a security advisory with full details.
| Severity | CVSS Score | Fix Target | Disclosure Target |
|---|---|---|---|
| Critical | 9.0 – 10.0 | ≤ 14 days | ≤ 30 days |
| High | 7.0 – 8.9 | ≤ 30 days | ≤ 60 days |
| Medium | 4.0 – 6.9 | ≤ 90 days | ≤ 90 days |
| Low | 0.1 – 3.9 | Best effort | Best effort |
These are SHOULD-level targets as defined by the NeoNephos Security Guidelines. The 90-day embargo ceiling is a MUST aligned with Google Project Zero. All timelines are measured from report receipt (Day 0); fix and disclosure may occur simultaneously.
We follow coordinated disclosure. We ask that you:
- Allow us reasonable time to investigate and address the vulnerability before public disclosure.
- Do not exploit the vulnerability beyond what is necessary to demonstrate the issue.
- Do not access or modify data belonging to other users.
We are committed to crediting reporters in our security advisories unless you prefer to remain anonymous.
CRA stewardship: This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described above, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project's emergency security reporting mechanisms as appropriate.
CRA Steward Contact: steward@linuxfoundation.org
For more information, see the NeoNephos Security Guidelines §11.
None yet. See Published Security Advisories once advisories are available.