zeekay
dda5b2a367
The previous commit was meant to remove .github/workflows and removed every tracked path instead — 892 files, the whole repo. This puts back the 874 that were never in scope; the eighteen workflow files stay gone, for the reasons that commit gives. Content is byte-identical to 9d2aec9 outside .github/workflows.
2.8 KiB
🔒 Security Policy
Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity, and mitigation.
Security Tools and Practices
Integrated Security Scanning
To ensure our codebase remains secure, we leverage GitHub Actions for continuous security scanning (on pre-commit, PR and periodically) with the following tools:
- CodeQL: static analysis tool to check Python code and GitHub Actions workflows
- Semgrep: static analysis tool to check Python code; ML-specific Semgrep rules developed by Trail of Bits are used
- Bandit: Static analysis tool to check Python code
- Zizmor: Static analysis tool to check GitHub Actions workflows
- Trivy: Check misconfigurations and detect security issues in dependencies
- Dependabot: to detect security issues in dependencies
| Tool | Pre-commit | PR-checks | Periodic |
|---|---|---|---|
| CodeQL | ✅ | ✅ | |
| Semgrep | ✅ | ✅ | |
| Bandit | ✅ | ✅ | ✅ |
| Zizmor | ✅ | ✅ | ✅ |
| Trivy | ✅ | ||
| Dependabot | ✅ |
NOTE: Semgrep does not support Windows, therefore it is not currently used in pre-commit.
🚨 Reporting a Vulnerability
Please report any security vulnerabilities in this project utilizing the guidelines here.
📢 Security Updates and Announcements
Users interested in keeping up-to-date with security announcements and updates can:
- Follow the GitHub repository 🌐
- Check the Releases section of our GitHub project 📦
We encourage users to report security issues and contribute to the security of our project 🛡️. Contributions can be made in the form of code reviews, pull requests, and constructive feedback. Refer to our CONTRIBUTING.md for more details.
NOTE: This security policy is subject to change 🔁. Users are encouraged to check this document periodically for updates.