bughz/code-server
1
0
Fork 0
mirror of https://github.com/coder/code-server.git synced 2024-12-05 07:13:06 +08:00
Code Issues Projects Releases Wiki Activity
a5225d3e06
code-server/docs/SECURITY.md
LG 10f57bac65
docs: Update some more links (#4806) 
* Update links in package.json

I will try checking the docs too

* docs: Update links in triage.md

* docs: Update links in npm.md

* docs: Update links in whatever files that have `cdr`

* Replace globally, thanks @bpmct!

* fix: coderer instead of coder
I should've used all three toggles in the Search/Replace tab in the GItHub.dev editor.

* Code Formatting
2022-02-01 09:45:19 -07:00

1.7 KiB
Raw Blame History

Security Policy

Coder and the code-server team want to keep the code-server project secure and safe for end-users.

Tools

We use the following tools to help us stay on top of vulnerability mitigation.

  • dependabot
    • Submits pull requests to upgrade dependencies. We use dependabot's version upgrades as well as security updates.
  • code-scanning
    • CodeQL
      • Semantic code analysis engine that runs on a regular schedule (see codeql-analysis.yml)
    • trivy
      • Comprehensive vulnerability scanner that runs on PRs into the default branch and scans both our container image and repository code (see trivy-scan-repo and trivy-scan-image jobs in ci.yaml)
  • audit-ci
    • Audits npm and Yarn dependencies in CI (see Audit for vulnerabilities step in ci.yaml) on PRs into the default branch and fails CI if moderate or higher vulnerabilities (see the audit.sh script) are present.

Supported Versions

Coder sponsors the development and maintenance of the code-server project. We will fix security issues within 90 days of receiving a report and publish the fix in a subsequent release. The code-server project does not provide backports or patch releases for security issues at this time.

Version Supported
Latest ✅

Reporting a Vulnerability

To report a vulnerability, please send an email to security[@]coder.com, and our security team will respond to you.