AK-21/Graphite-Industrial-Intelligence

1# Incident Response Process for **resolve**2 3## Reporting a Vulnerability4 5We take the security of **resolve** very seriously. If you believe you’ve found a security vulnerability, please inform us responsibly through coordinated disclosure.6 7### How to Report8 9> **Do not** report security vulnerabilities through public GitHub issues, discussions, or social media.10 11Instead, please use one of these secure channels:12 131. **GitHub Security Advisories**14   Use the **Report a vulnerability** button in the Security tab of the [browserify/resolve repository](https://github.com/browserify/resolve).15 162. **Email**17   Follow the posted [Security Policy](https://github.com/browserify/resolve/security/policy).18 19### What to Include20 21**Required Information:**22- Brief description of the vulnerability type23- Affected version(s) and components24- Steps to reproduce the issue25- Impact assessment (what an attacker could achieve)26- Confirm the issue is not present in test files (in other words, only via the official entry points in `exports`)27 28**Helpful Additional Details:**29- Full paths of affected source files30- Specific commit or branch where the issue exists31- Required configuration to reproduce32- Proof-of-concept code (if available)33- Suggested mitigation or fix34 35## Our Response Process36 37**Timeline Commitments:**38- **Initial acknowledgment**: Within 24 hours39- **Detailed response**: Within 3 business days40- **Status updates**: Every 7 days until resolved41- **Resolution target**: 90 days for most issues42 43**What We’ll Do:**441. Acknowledge your report and assign a tracking ID452. Assess the vulnerability and determine severity463. Develop and test a fix474. Coordinate disclosure timeline with you485. Release a security update and publish an advisory and CVE496. Credit you in our security advisory (if desired)50 51## Disclosure Policy52 53- **Coordinated disclosure**: We’ll work with you on timing54- **Typical timeline**: 90 days from report to public disclosure55- **Early disclosure**: If actively exploited56- **Delayed disclosure**: For complex issues57 58## Scope59 60**In Scope:**61- **resolve** package (all supported versions)62- Official examples and documentation63- Core resolution APIs64- Dependencies with direct security implications65 66**Out of Scope:**67- Third-party wrappers or extensions68- Bundler-specific integrations69- Social engineering or physical attacks70- Theoretical vulnerabilities without practical exploitation71- Issues in non-production files72 73## Security Measures74 75**Our Commitments:**76- Regular vulnerability scanning via `npm audit`77- Automated security checks in CI/CD (GitHub Actions)78- Secure coding practices and mandatory code review79- Prompt patch releases for critical issues80 81**User Responsibilities:**82- Keep **resolve** updated83- Monitor dependency vulnerabilities84- Follow secure configuration guidelines for module resolution85 86## Legal Safe Harbor87 88**We will NOT:**89- Initiate legal action90- Contact law enforcement91- Suspend or terminate your access92 93**You must:**94- Only test against your own installations95- Not access, modify, or delete user data96- Not degrade service availability97- Not publicly disclose before coordinated disclosure98- Act in good faith99 100## Recognition101 102- **Advisory Credits**: Credit in GitHub Security Advisories (unless anonymous)103 104## Security Updates105 106**Stay Informed:**107- Subscribe to npm updates for **resolve**108- Enable GitHub Security Advisory notifications109 110**Update Process:**111- Patch releases (e.g., 1.22.10 → 1.22.11)112- Out-of-band releases for critical issues113- Advisories via GitHub Security Advisories114 115## Contact Information116 117- **Security reports**: Security tab of [browserify/resolve](https://github.com/browserify/resolve/security)118- **General inquiries**: GitHub Discussions or Issues119 120