powerdns-admin/SECURITY.md

# Security Policy

## No Warranty

Per the terms of the MIT license, PDA is offered "as is" and without any guarantee or warranty pertaining to its operation. While every reasonable effort is made by its maintainers to ensure the product remains free of security vulnerabilities, users are ultimately responsible for conducting their own evaluations of each software release.

## Recommendations

Administrators are encouraged to adhere to industry best practices concerning the secure operation of software, such as:

* Do not expose your PDA installation to the public Internet
* Do not permit multiple users to share an account
* Enforce minimum password complexity requirements for local accounts
* Prohibit access to your database from clients other than the PDA application
* Keep your deployment updated to the most recent stable release

## Reporting a Suspected Vulnerability

If you believe you've uncovered a security vulnerability and wish to report it confidentially, you may do so via email. Please note that any reported vulnerabilities **MUST** meet all the following conditions:

* Affects the most recent stable release of PDA, or a current beta release
* Affects a PDA instance installed and configured per the official documentation
* Is reproducible following a prescribed set of instructions

Please note that we **DO NOT** accept reports generated by automated tooling which merely suggest that a file or file(s) _may_ be vulnerable under certain conditions, as these are most often innocuous.

If you believe that you've found a vulnerability which meets all of these conditions, please [submit a draft security advisory](https://github.com/PowerDNS-Admin/PowerDNS-Admin/security/advisories/new) on GitHub, or email a brief description of the suspected bug and instructions for reproduction to **admin@powerdnsadmin.org**.

### Bug Bounties

As PDA is provided as free open source software, we do not offer any monetary compensation for vulnerability or bug reports, however your contributions are greatly appreciated.
Updated project README to include references to the new security policy. Moved the project's code of conduct out of the contributions guide and into the appropriate policy file. Updated the contribution guide to follow the NetBox project format. Added various issue templates based on the NetBox project formats but updated for PDA. Added additional GitHub workflows to handle stale and closed issue and PR management. Removed legacy stale issue workflow that was not in use. 2023-03-17 20:42:05 +00:00			`# Security Policy`

			`## No Warranty`

			`Per the terms of the MIT license, PDA is offered "as is" and without any guarantee or warranty pertaining to its operation. While every reasonable effort is made by its maintainers to ensure the product remains free of security vulnerabilities, users are ultimately responsible for conducting their own evaluations of each software release.`

			`## Recommendations`

			`Administrators are encouraged to adhere to industry best practices concerning the secure operation of software, such as:`

			`* Do not expose your PDA installation to the public Internet`
			`* Do not permit multiple users to share an account`
			`* Enforce minimum password complexity requirements for local accounts`
			`* Prohibit access to your database from clients other than the PDA application`
			`* Keep your deployment updated to the most recent stable release`

			`## Reporting a Suspected Vulnerability`

			`If you believe you've uncovered a security vulnerability and wish to report it confidentially, you may do so via email. Please note that any reported vulnerabilities MUST meet all the following conditions:`

			`* Affects the most recent stable release of PDA, or a current beta release`
			`* Affects a PDA instance installed and configured per the official documentation`
			`* Is reproducible following a prescribed set of instructions`

			`Please note that we DO NOT accept reports generated by automated tooling which merely suggest that a file or file(s) _may_ be vulnerable under certain conditions, as these are most often innocuous.`

			`If you believe that you've found a vulnerability which meets all of these conditions, please [submit a draft security advisory](https://github.com/PowerDNS-Admin/PowerDNS-Admin/security/advisories/new) on GitHub, or email a brief description of the suspected bug and instructions for reproduction to admin@powerdnsadmin.org.`

			`### Bug Bounties`

			`As PDA is provided as free open source software, we do not offer any monetary compensation for vulnerability or bug reports, however your contributions are greatly appreciated.`