Security policy¶
Cozens Software Solutions Limited (COSOSO) takes the security of SolidSyslog seriously. This policy explains how to report a vulnerability and what to expect in return.
Reporting a vulnerability¶
Please do not report security issues in public GitHub issues, pull requests, or discussions. Use one of the private channels below:
- GitHub private vulnerability reporting (preferred). Open a private report directly at https://github.com/cososo-ltd/solid-syslog/security/advisories/new, or from this repository's Security tab → Report a vulnerability. This opens a private advisory visible only to you and the maintainer.
- Email. Write to security@cososo.co.uk. Use this if you have something to attach - a proof of concept, a crash dump, a packet capture, a patch - which the web form cannot take.
- Web form. Submit the form at https://cososo.co.uk/security/report. It routes to a private inbox, and needs neither a GitHub account nor a working mail client.
Email is not encrypted in transit beyond what our providers negotiate. For anything you need protected, use GitHub private vulnerability reporting: it is the reason that channel is listed first. We do not currently publish a PGP key, and would rather say so than leave you guessing - if you need material encrypted in transit, that is the channel to use.
All three routes reach the maintainer privately.
What to include¶
The more of this you can provide, the faster we can triage:
- Affected component - Core, Platform, or Bdd (see Scope below)
- Affected version, tag, or commit SHA
- A description of the issue and its impact
- Reproduction steps or a proof of concept (attach it if you are writing by email)
- Your assessment of severity, and whether it is being actively exploited
- Whether you wish to be credited, and how
Our commitments¶
For the free tier - either of the two free licences in
LICENSE.md:
- Acknowledgement within 72 hours of receipt.
- Initial triage and a CVSS v3.1 assessment within 7 days.
- Fixes are best-effort and severity-driven. The free tier carries no fixed fix-time SLA. A commercial licence with maintenance carries committed response times and a fix-or-workaround deadline - see Commercial support.
These timelines are best-effort commitments from a solo maintainer. They may be exceeded during periods of illness, bereavement, or other circumstances beyond the maintainer's control. In such cases the report will be acknowledged and acted on as soon as is practicable.
Coordinated disclosure¶
We follow coordinated disclosure with a 90-day window from the date of report, plus a 14-day grace period if a fix is imminent at day 90. We will credit reporters who wish to be named - tell us your preference in your report.
Advisories are published as GitHub Security Advisories. For vulnerabilities in Core (see Scope), a CVE is requested via GitHub's CNA.
Scope¶
SolidSyslog is a source-available component assembled into a product by the integrator. Security treatment follows the repository's support tiers:
| Tier | Path | Treatment |
|---|---|---|
| 1 | Core/ |
Full treatment: CVE, advisory, fix, signed release, SBOM entry. |
| 2 | Platform/ |
Advisory treatment: public notice and an updated adapter. No CVE unless the root cause is in Core/. |
| 3 | Bdd/Targets/ |
Advisory treatment. Illustrative targets, not a supported product. |
Test code, build infrastructure, CI configuration, and documentation are not in scope for this policy. Vulnerabilities in third-party libraries you choose to link (OpenSSL, Mbed TLS, an RTOS TCP stack, …) are the responsibility of those projects and your own supply-chain process; SolidSyslog bundles none of them.
See the threat model for the edges the library crosses in your product, your obligations as its caller, and what it deliberately does not do.
Supported versions¶
SolidSyslog is developed as a single mainline. On the free tier, security fixes land on the latest published release only; there is no back-port commitment.
A commercial licensee declares each year which releases its products ship. A vulnerability in SolidSyslog is fixed for every declared release, free of charge and whether or not maintenance is renewed, for five years from that release's publication or for as long as it stays declared, up to ten years. Where moving to the latest release is not an option, the fix is issued as a patch release of the declared release, so a licensee is never required to take a feature release to receive a security fix.
Vulnerabilities in the third-party libraries a product links against are outside this commitment, as Scope states. Following a library's own breaking update is maintenance work, not a security fix.
Continuity¶
If COSOSO ceases to maintain SolidSyslog without transferring it to a
successor maintainer, the continuity commitment stated in
LICENSE.md applies.
Commercial support¶
Under a commercial licence with maintenance in force, the commitments are:
- Acknowledgement of a reported defect or vulnerability within 2 business days.
- Triage and a CVSS v3.1 assessment within 5 business days.
- For a vulnerability assessed High or Critical, a fix or a documented workaround within 30 days of triage.
These carry the same solo-maintainer qualification as the free tier above. Security fixes for declared releases are free regardless of maintenance, as Supported versions states.
For commercial licensing enquire via the form at cososo.co.uk.