Skip to content

Repository navigation

docs: resolve the three open questions left in the patch policy #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aljo242 merged 3 commits into from
Oct 1, 2026
Merged

docs: resolve the three open questions left in the patch policy #20

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
52e2f43
docs: resolve the three open questions left in the patch policy
aljo242 Oct 1, 2026
72eaf1d
docs: separate withdrawing access from the disclosure consequences
aljo242 Oct 1, 2026
6f96d9a
docs: tighten the access-withdrawal wording
aljo242 Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 20 additions & 7 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,10 +91,10 @@ disclosure all follow the same path.
### Monthly private repositories

Cosmos Labs maintains a set of private repositories each month, one for each
repository in bug bounty scope. Coverage targets the repositories downstream
chains depend on most, including the Cosmos SDK, CometBFT, IBC-Go, Cosmos EVM,
and the CosmWasm repositories. They are named for the repository and the month,
for example `cosmos-sdk-priv-july-2026`.
repository in bug bounty scope. That includes the Cosmos SDK, CometBFT, IBC-Go,
Cosmos EVM and the CosmWasm repositories, and is not limited to them. They
are named for the repository and the month, for example
`cosmos-sdk-priv-july-2026`.

Access is granted to downstream teams that have passed KYC and run the
repository in production. Each month's repositories are created fresh and
Expand All @@ -120,6 +120,18 @@ is public, do not publish it in a public repository, do not commit it to one
inside a vendored dependency tree, and do not make it available to validators or
node operators.

A team that passes patch source to anyone outside the teams that already have
access, before the patch is public, loses access to the private repositories,
including the invitations to any future ones. This is a serious violation of
secure disclosure and puts all other chains at risk.

That is not a penalty under
[Consequences of Improper Disclosure](#consequences-of-improper-disclosure).
Access to the private repositories is granted on the condition that the source
stays private, so breaking that condition ends the grant. Those consequences may
apply as well, and we may take further action where the disclosure put chains at
risk.

Distributing a built binary that contains the patch is allowed, through whatever
mechanism the chain already uses, including GitHub release artifacts, provided no
patch source is included.
Expand Down Expand Up @@ -177,9 +189,10 @@ a critical landing in a private repository and its public release.

A vulnerability that is being actively exploited, or where we confirm attacker
awareness ahead of the scheduled release, leaves the monthly cycle and is
handled as an incident. That means emergency mitigations, private fix
distribution, or a coordinated upgrade, ahead of any public disclosure. This
applies regardless of the original severity classification.
handled immediately and separately as an incident. That means emergency
mitigations, private fix distribution, or a coordinated upgrade, ahead of any
public disclosure. This applies regardless of the original severity
classification.

------------------------------------------------------------------------

Expand Down
Loading