Add SECURITY.md#342
Conversation
| # Security Policy | ||
|
|
||
| `velox-testing` is the CI / build / benchmark infrastructure used to test the | ||
| RAPIDS GPU integrations with Apache Velox, PrestoDB native (with the Velox |
There was a problem hiding this comment.
Velox is not an Apache project.
| RAPIDS GPU integrations with Apache Velox, PrestoDB native (with the Velox | |
| RAPIDS GPU integrations with Velox, PrestoDB native (with the Velox |
More broadly, can we please shrink this document? There are many specific details about the current contents of the repo that may change (scope, included projects, tooling, dependencies, etc.). I would like our security document to be evergreen.
|
|
||
| - **Compute-sanitizer outputs are treated as pre-disclosure.** | ||
| Findings produced by `velox-compute-sanitizer-run.yaml` may | ||
| represent undisclosed memory-safety bugs. Logs, artifacts, and |
There was a problem hiding this comment.
Let's delete this section.
We will continue running compute-sanitizer in our publicly visible CI so that we can catch and fix bugs. Hiding logs is not a real answer to that.
|
|
||
| - **Upstream sources are pinned per build.** | ||
| Builds should consume specific commits of Velox, Presto, and | ||
| Spark Gluten — not floating branches — so that a compromised |
There was a problem hiding this comment.
Let's delete this section.
We run nightly again main of upstream repos. This is by design. Pinning is not the goal here.
| ## Supported Versions | ||
|
|
||
| velox-testing follows a rolling-`main` model with periodic staging | ||
| branches created by `scripts/create_staging_branch.sh`. Security fixes |
There was a problem hiding this comment.
We don't actually do anything with staging today. This "Supported Versions" section can be removed (nothing from this repo has stability or long-term support).
4 participants
This PR adds a SECURITY.md file to the repository, outlining the security policies and procedures for reporting vulnerabilities. This is part of our effort to enhance the security posture of our projects and ensure that we have a clear process for handling security issues.