Commit a424877
doc: exclude compile-time flag features from security policy
Add a new section to the security model clarifying that experimental
features behind compile-time flags are not covered by the vulnerability
reporting policy. These features are intended for development only and
are not enabled in official releases.
PR-URL: #61109
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>1 parent 5e6ffd9 commit a424877
1 file changed
Lines changed: 20 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -125,6 +125,26 @@ This policy recognizes that experimental platforms may not compile, may not | |||
| 125 | 125 | pass the test suite, and do not have the same level of testing and support | |
| 126 | 126 | infrastructure as Tier 1 and Tier 2 platforms. | |
| 127 | 127 | ||
| 128 | + ### Experimental features behind compile-time flags | ||
| 129 | + | ||
| 130 | + Node.js includes certain experimental features that are only available when | ||
| 131 | + Node.js is compiled with specific flags. These features are intended for | ||
| 132 | + development, debugging, or testing purposes and are not enabled in official | ||
| 133 | + releases. | ||
| 134 | + | ||
| 135 | + * Security vulnerabilities that only affect features behind compile-time flags | ||
| 136 | + will **not** be accepted as valid security issues. | ||
| 137 | + * Any issues with these features will be treated as normal bugs. | ||
| 138 | + * No CVEs will be issued for issues that only affect compile-time flag features. | ||
| 139 | + * Bug bounty rewards are not available for compile-time flag feature issues. | ||
| 140 | + | ||
| 141 | + This policy recognizes that experimental features behind compile-time flags | ||
| 142 | + are not ready for public consumption and may have incomplete implementations, | ||
| 143 | + missing security hardening, or other limitations that make them unsuitable | ||
| 144 | + for production use. | ||
| 145 | + | ||
| 146 | + ### What constitutes a vulnerability | ||
| 147 | + | ||
| 128 | 148 | Being able to cause the following through control of the elements that Node.js | |
| 129 | 149 | does not trust is considered a vulnerability: | |
| 130 | 150 | ||
0 commit comments