Governance Update

SECURITY.md

@@ -0,0 +1,177 @@
+<!--
+ Copyright (C) 2025 Moko Consulting <hello@mokoconsulting.tech>
+
+ This file is part of a Moko Consulting project.
+
+ SPDX-License-Identifier: GPL-3.0-or-later
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License (./LICENSE.md).
+
+ # FILE INFORMATION
+ DEFGROUP: Joomla.Template
+ INGROUP: Moko-Cassiopeia.Governance
+ REPO: https://github.com/mokoconsulting-tech/moko-cassiopeia
+ FILE: SECURITY.md
+ VERSION: 03.05.00
+ BRIEF: Security policy and vulnerability reporting process for Moko-Cassiopeia.
+ PATH: /SECURITY.md
+ NOTE: This policy is process oriented and does not replace secure engineering practices.
+-->
+
+## Security Policy
+
+This document defines how Moko-Cassiopeia handles vulnerability intake, triage, remediation, and disclosure. The objective is to reduce risk, protect downstream users, and preserve operational continuity with a verifiable audit trail.
+
+## Scope
+
+This policy applies to:
+
+* Repository source code, workflows, scripts, and build artifacts.
+* Release packaging (ZIP outputs) generated from the repository.
+* Configuration and metadata used for distribution (for example manifests and update metadata).
+
+Out of scope:
+
+* Vulnerabilities in upstream Joomla core, third party extensions, or external infrastructure not controlled by this repository.
+* Issues that require physical access to a host, compromised administrator credentials, or a compromised hosting provider, unless the repository materially increases impact.
+
+## Supported Versions
+
+Security fixes are prioritized for:
+
+* The latest released version.
+* The current development line when it is actively used for release engineering.
+
+Backports may be provided based on impact, deployment footprint, and engineering capacity.
+
+## Reporting a Vulnerability
+
+Use one of the following channels:
+
+* GitHub Security Advisories (preferred): use the repository security tab to submit a private report.
+* Email: send details to `hello@mokoconsulting.tech` with subject `SECURITY: Moko-Cassiopeia vulnerability report`.
+
+Do not file a public GitHub issue for suspected security vulnerabilities.
+
+### What to include
+
+Provide enough detail to reproduce and triage:
+
+* A clear description of the vulnerability and expected impact.
+* A minimal proof of concept or reproduction steps.
+* Affected versions, configuration assumptions, and environment details.
+* Any proposed mitigation or patch.
+* Your preferred contact details for follow up.
+
+## Triage and Response Targets
+
+The project operates with response targets aligned to practical delivery realities:
+
+* **Acknowledgement:** within 3 business days.
+* **Initial triage:** within 10 business days.
+* **Fix plan:** communicated once severity is confirmed.
+
+These targets are not guarantees. Complex issues, supply chain considerations, and coordination with upstream vendors may extend timelines.
+
+## Severity Assessment
+
+Issues are triaged based on business impact and technical exploitability, including:
+
+* Remote exploitability and required privileges.
+* Data confidentiality, integrity, and availability impact.
+* Likelihood of exploitation in typical Joomla deployments.
+* Exposure surface (public endpoints, administrator area, installation flows, and update mechanisms).
+
+When appropriate, industry standard scoring such as CVSS may be used for internal prioritization.
+
+## Coordinated Disclosure
+
+The project follows coordinated vulnerability disclosure:
+
+* Reports are treated as confidential until remediation is available.
+* A public advisory may be published once a fix is released.
+* A reasonable embargo period is expected to enable patch distribution.
+
+If you believe disclosure is time sensitive due to active exploitation, include that assessment and any supporting indicators.
+
+## Security Updates and Advisories
+
+Security updates are distributed through:
+
+* GitHub releases for the repository.
+* GitHub Security Advisories when applicable.
+
+Advisories may include:
+
+* Affected versions and fixed versions.
+* Mitigations and workarounds when a fix is not immediately available.
+* Upgrade guidance.
+
+## Dependencies and Supply Chain Controls
+
+The project aims to manage supply chain risk through:
+
+* Pinning and review of workflow dependencies where feasible.
+* Minimizing privileged GitHub token permissions.
+* Validating build inputs prior to packaging releases.
+
+If you identify a supply chain issue (for example compromised action, dependency confusion, or malicious upstream artifact), report it as a vulnerability.
+
+## Secure Development and CI Expectations
+
+Security posture is reinforced through operational controls:
+
+* CI validation for packaging inputs and manifest integrity.
+* Consistent path normalization and whitespace hygiene checks where required for release correctness.
+* Least privilege for GitHub Actions permissions.
+
+This policy does not guarantee that all vulnerabilities will be prevented. It defines how risk is managed when issues are discovered.
+
+## Safe Harbor
+
+The project supports good faith security research. When you:
+
+* Avoid privacy violations, data destruction, and service disruption.
+* Limit testing to systems you own or have explicit permission to test.
+* Provide a reasonable window for coordinated disclosure.
+
+Then the project will treat your report as a constructive security contribution.
+
+Jurisdiction note: this repository is managed from Tennessee, USA. This note is informational only and does not constitute legal advice.
+
+## Public Communications
+
+Only maintainers will publish security advisories or public statements for confirmed vulnerabilities. Public communication will focus on actionable remediation and operational risk reduction.
+
+## Acknowledgements
+
+If you want credit, include the name or handle to list in an advisory. If you prefer anonymity, state that explicitly.
+
+---
+
+## Metadata
+
+* **Document:** SECURITY.md
+* **Repository:** [https://github.com/mokoconsulting-tech/moko-cassiopeia](https://github.com/mokoconsulting-tech/moko-cassiopeia)
+* **Path:** /SECURITY.md
+* **Owner:** Moko Consulting
+* **Version:** 03.05.00
+* **Status:** Active
+* **Effective Date:** 2025-12-18
+* **Last Reviewed:** 2025-12-18
+
+## Revision History
+
+| Date       | Change Summary                                                                                   | Author          |
+| ---------- | ------------------------------------------------------------------------------------------------ | --------------- |
+| 2025-12-18 | Initial publication of security policy, intake channels, triage targets, and disclosure process. | Moko Consulting |