Commit 18ceefb
doc: clarify experimental platform vulnerability policy
Adds a new section to the threat model specifying that security
vulnerabilities affecting only experimental platforms will not be
accepted as valid security issues and will be treated as normal bugs.
This clarifies that experimental OS/hardware combinations do not
qualify for CVEs or bug bounty rewards, aligning with their limited
testing and support infrastructure.
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #59591
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>1 parent e95c9b2 commit 18ceefb
1 file changed
Lines changed: 16 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -102,6 +102,22 @@ vulnerability in the context of the Node.js threat model. In other | |||
| 102 | 102 | words, it cannot assume that a trusted element (such as the operating | |
| 103 | 103 | system) has been compromised. | |
| 104 | 104 | ||
| 105 | + ### Experimental platforms | ||
| 106 | + | ||
| 107 | + Node.js maintains a tier-based support system for operating systems and | ||
| 108 | + hardware combinations (Tier 1, Tier 2, and Experimental). For platforms | ||
| 109 | + classified as "Experimental" in the [supported platforms](BUILDING.md#supported-platforms) | ||
| 110 | + documentation: | ||
| 111 | + | ||
| 112 | + * Security vulnerabilities that only affect experimental platforms will **not** be accepted as valid security issues. | ||
| 113 | + * Any issues on experimental platforms will be treated as normal bugs. | ||
| 114 | + * No CVEs will be issued for issues that only affect experimental platforms | ||
| 115 | + * Bug bounty rewards are not available for experimental platform-specific issues | ||
| 116 | + | ||
| 117 | + This policy recognizes that experimental platforms may not compile, may not | ||
| 118 | + pass the test suite, and do not have the same level of testing and support | ||
| 119 | + infrastructure as Tier 1 and Tier 2 platforms. | ||
| 120 | + | ||
| 105 | 121 | Being able to cause the following through control of the elements that Node.js | |
| 106 | 122 | does not trust is considered a vulnerability: | |
| 107 | 123 | ||
0 commit comments