docs: add vulnerability disclosure statement #138
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| # pgEdge Vulnerability Disclosure Statement | ||
|
|
||
| pgEdge welcomes reports of security vulnerabilities in our products. | ||
|
|
||
| ## Reporting | ||
|
|
||
| Email [**security@pgedge.com**](mailto:security@pgedge.com). Tell us the | ||
| product and version, what the impact is, and how to reproduce it. Please | ||
| do not open a public issue for a suspected vulnerability. | ||
|
|
||
| You do not need to sign anything or hold a pgEdge contract to report to | ||
| us. We acknowledge reports within five business days, tell you the | ||
| outcome of our assessment, and tell you before we publish anything. | ||
|
|
||
| ## Scope | ||
|
|
||
| **pgEdge software you run yourself** is in scope: our self-managed | ||
| products, command line tools, PostgreSQL extensions, container images, | ||
| and libraries we publish for use in other software. Our public | ||
| repositories are at `github.com/pgEdge`. You may test these freely in an | ||
| environment you control, and need no permission from us to do so. | ||
|
|
||
| **Testing pgEdge Cloud requires prior written authorisation.** It is a | ||
| shared production service, so unauthorised testing risks other | ||
| customers' data and is not covered by the safe harbour below. Customers | ||
| wanting to test their own environment should start from their agreement | ||
| with us. If you are not a customer and believe you have found an issue | ||
| in Cloud, tell us what you observed and stop there — we would rather | ||
| have a partial report than one obtained by probing a live service. We | ||
| will not penalise anyone who encounters an issue incidentally and stops | ||
| to report it. | ||
|
|
||
| **We are unlikely to act on** automated scanner output with no | ||
| demonstrated impact, denial of service by traffic volume alone, or | ||
| reports about a language model's output quality, accuracy or refusal | ||
| behaviour. Our products integrate language models, and model behaviour | ||
| that crosses a security boundary is in scope — untrusted content | ||
| reaching a privileged position in a prompt, causing a privileged action | ||
| to be taken, or causing data or credentials to be disclosed. A model | ||
| simply answering poorly is not. If you think something here does have a | ||
| security impact in our products, say so and explain why. | ||
|
|
||
| ## Safe harbour | ||
|
|
||
| If you research a vulnerability in good faith under this statement, we | ||
| will consider that research authorised and will not pursue or support | ||
| legal action against you over it. | ||
|
|
||
| Good faith means you do not access, modify or retain anyone else's data, | ||
| and stop as soon as you establish that you could; do not degrade our | ||
| services or our customers'; do not use a finding to extract payment or | ||
| publicity; give us a reasonable opportunity to fix the issue before | ||
| publishing; and comply with applicable law. | ||
|
|
||
| This does not authorise testing pgEdge Cloud, or any system belonging to | ||
| a pgEdge customer. | ||
|
|
||
| ## Credit | ||
|
|
||
| We credit reporters in published advisories however you prefer, | ||
| including anonymously — tell us when you report. We do not operate a | ||
| paid bug bounty programme. | ||
|
|
||
| ## Advisories and CVE identifiers | ||
|
|
||
| Advisories are published as GitHub Security Advisories in the repository | ||
| of the affected product, under its Security tab, and are discoverable in | ||
| the GitHub Advisory Database at `github.com/advisories`. For our Go | ||
| libraries they reach the Go vulnerability database, so `govulncheck` and | ||
| Dependabot will report them to you. | ||
|
Comment on lines
+66
to
+70
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- target file ---'
cat -n docs/security/index.md | sed -n '55,90p'
printf '%s\n' '--- related references ---'
rg -n -i 'Dependabot|govulncheck|vulnerability database|Go vulnerability' . --glob '!node_modules' --glob '!dist' --glob '!build' | head -200Repository: pgEdge/pgedge-docs Length of output: 1813 🌐 Web query:
💡 Result: GitHub Dependabot integrates with the Go ecosystem by leveraging the GitHub Advisory Database, which includes curated vulnerability data for Go modules [1][2]. How Dependabot Detects Go Vulnerabilities: 1. Dependency Graph Analysis: GitHub maintains a dependency graph for your repository by analyzing manifest files, specifically Citations:
Qualify the Dependabot notification claim. Dependabot alerts require a detected dependency, a matching GitHub Advisory Database record, and enabled alerts. A Go vulnerability database entry alone does not guarantee an alert for every consumer. Replace “will report them to you” with conditional wording. 🤖 Prompt for AI Agents |
||
|
|
||
| We request a CVE identifier where the vulnerable code was present in a | ||
| released General Availability version and is reachable by someone other | ||
| than the installer/operator of the software. We do not request one for a | ||
| fix to code that was never released, or where a trusted, | ||
| operator-configured component would have to misbehave. CVE identifiers | ||
| belonging to dependencies we consume are referenced in our release | ||
| notes, not re-filed by us. | ||
|
|
||
| ## Supported versions | ||
|
|
||
| Security fixes are provided for the latest release of each product. | ||
| Where a product has its own published support lifecycle, that lifecycle | ||
| governs. | ||
|
Comment on lines
+80
to
+84
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- target file ---'
cat -n docs/security/index.md | sed -n '1,110p'
printf '%s\n' '--- repository policy and release references ---'
rg -n -i --glob '!node_modules' --glob '!dist' \
'support(ed)? versions?|support lifecycle|latest release|release policy|effective date|security policy|product' \
README.md docs .github 2>/dev/null | head -250
printf '%s\n' '--- changed-file summary ---'
git diff --statRepository: pgEdge/pgedge-docs Length of output: 15398 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- versioned-documentation rules ---'
cat -n README.md | sed -n '1,115p'
printf '%s\n' '--- product/version navigation entries ---'
rg -n -i --glob 'mkdocs*.yml' --glob '*.yaml' --glob '*.yml' \
'^[[:space:]-]+(v?[0-9]+|[A-Za-z][A-Za-z0-9 ._-]+):|version|Spock|Platform|Cloud' . | head -250
printf '%s\n' '--- support/lifecycle wording outside the target policy ---'
rg -n -i --glob '!node_modules' --glob '!dist' \
'support lifecycle|supported versions|security fixes|security support|end[- ]of[- ]life|EOL|latest release' . | head -250Repository: pgEdge/pgedge-docs Length of output: 16906 🌐 Web query:
💡 Result: pgEdge offers enterprise-grade support subscriptions that provide 24x7x365 access to PostgreSQL experts, including bug and security fixes for its hardened PostgreSQL packages and included extensions [1][2][3][4]. Supported PostgreSQL Versions As of August 2026, pgEdge supports the following PostgreSQL major versions across its various deployment options: - Enterprise Postgres (VM/Bare Metal): PostgreSQL 16, 17, and 18 [2]. - Distributed Postgres: PostgreSQL 15, 16, and 17 [1]. - Control Plane: Supports PostgreSQL 16, 17, and 18 [1]. Support Lifecycle and Security - Commercial Support: Subscribers receive 24x7x365 support with defined Service Level Agreements (SLAs), including security updates, bug fixes, and access to certified builds [1][2][3]. - Patching Policy: pgEdge emphasizes prompt adoption of patch releases. For components managed under its CloudNativePG integrations, the company maintains a support policy where minor releases are supported until three months after the release of the subsequent (N+1) minor version [5][6]. Security fixes are backported to all currently supported releases [5][6]. - Updates: Customers are encouraged to use pgEdge’s secure repositories for hardened, tested packages [1][4]. Users can perform in-place minor version upgrades for Postgres and its supporting components [2]. Latest Releases - Recent minor updates for Enterprise Postgres have included versions 16.14, 17.10, and 18.4 [7]. - The pgEdge Platform v25 was a major milestone announced in March 2026 [8]. - Infrastructure-as-code components, such as the pgEdge Helm chart, have seen releases as recently as August 2026 (v1.1.0) [9]. For technical assistance or to create a support ticket, users can access the official portal at support.pgedge.com or contact the team via the pgEdge Discord server [3][10]. Citations:
Define the supported-version baseline. The documentation navigation defines the latest version, but this policy does not state whether that version is the security baseline. Define “latest release” for each product and link to each product’s support lifecycle. State which rule controls when the rules differ. 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: pgEdge/pgedge-docs
Length of output: 8886
🏁 Script executed:
Repository: pgEdge/pgedge-docs
Length of output: 2610
🌐 Web query:
site:docs.pgedge.com/security pgEdge vulnerability disclosure statement safe harbour💡 Result:
I couldn’t find a pgEdge page at
docs.pgedge.com/securityor a publicly indexed pgEdge vulnerability-disclosure/safe-harbor statement. The pgEdge documentation site is available, but its indexed security pages concern PostgreSQL features and product security—not researcher disclosure policy. [1][2]You may need to check pgEdge’s main website or contact pgEdge directly for its current security-reporting process.
🏁 Script executed:
Repository: pgEdge/pgedge-docs
Length of output: 2230
Obtain legal approval and set an effective date before publishing this policy.
The safe-harbour text commits pgEdge to authorize qualifying research and not pursue legal action. Do not publish
https://docs.pgedge.com/securityuntil legal review and the effective date are complete.🧰 Tools
🪛 LanguageTool
[style] ~52-~52: Consider using a different verb for a more formal wording.
Context: ...ty; give us a reasonable opportunity to fix the issue before publishing; and comply...
(FIX_RESOLVE)
🤖 Prompt for AI Agents