You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: security.md
+22Lines changed: 22 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,3 +35,25 @@ Objectives and Functioning:
35
35
* Their insights and recommendations are directly incorporated into our development process, leading to more secure and reliable software.
36
36
37
37
We welcome participation from our user community. If you have a keen interest in security and wish to contribute, please [contact us](mailto:info@nvaccess.org).
38
+
39
+
## Severity Levels
40
+
41
+
* P1 (Critical): Vulnerabilities with a medium or higher severity (CVSS 4+) causing a significant risk to the security and privacy of NVDA users.
42
+
* P2 (High): Vulnerabilities with a low severity (CVSS <4) that present a potential security risk.
43
+
44
+
## Response Timelines (SLAs)
45
+
46
+
* Acknowledgement and Triage: Within 3 business days of receipt.
47
+
* P1 (Critical):
48
+
* Planning and Mitigation: Detailed assessment of the issue and assessment of possible technical solutions within 1 week of triage. Development of a resolution will then begin immediately.
49
+
* Patch Release: Target patch release of a workaround within 2 weeks of completing assessment. A thorough and complete resolution may need to be scheduled into the next minor release.
50
+
* P2 (High):
51
+
* Planning and Mitigation: Assessment within 2 weeks of triage.
52
+
* Patch Release: Target patch release in the next scheduled minor release.
53
+
* Security Advisory: A security advisory will be published concurrently with the release of the patch. The advisory will provide details of the vulnerability and rectification steps. As details of the vulnerability will be available in the code repository, immediate disclosure aligns with responsible disclosure principles.
54
+
55
+
## Resource Allocation
56
+
57
+
* P1 (Critical): Immediate attention from core developers and/or the Security Advisory Group. Other development tasks may be temporarily deprioritised.
58
+
* P2 (High): Dedicated resources will be allocated, with prioritisation based on severity and available development bandwidth.
0 commit comments