1# Project security policy
2
3The MCUboot team takes security, vulnerabilities, and weaknesses
4seriously.
5
6## Reporting security issues
7
8The preferred way to report security issues with MCUboot is via the "Report a
9security vulnerability" button on the main [security
10page](https://github.com/mcu-tools/mcuboot/security).
11
12You can also directly contact the following maintainers of the project:
13
14- David Brown: davidb@davidb.org or david.brown@linaro.org
15- Fabio Utzig: utzig@apache.org
16
17If you wish to send an encrypted email, you may use these PGP keys:
18
19```
20    pub   rsa4096 2011-10-14 [SC]
21          DAFD760825AE2636AEA9CB19E6BA9F5C5E54DF82
22    uid           [ultimate] David Brown <davidb@davidb.org>
23    uid           [ultimate] David Brown <david.brown@linaro.org>
24    sub   rsa4096 2011-10-14 [E]
25```
26
27and
28
29```
30    pub   rsa4096 2017-07-28 [SC]
31          126087C7E725625BC7E89CC7537097EDFD4A7339
32    uid           [ unknown] Fabio Utzig <utzig@apache.org>
33    uid           [ unknown] Fabio Utzig <utzig@utzig.org>
34    sub   rsa4096 2017-07-28 [E]
35```
36
37Please include the word "SECURITY" as well as "MCUboot" in the subject
38of any message.
39
40We will make our best effort to respond in a timely manner. Most
41vulnerabilities found within published code will undergo an embargo of
4290 days to allow time fixes to be developed and deployed.
43
44## Vulnerability advisories
45
46Vulnerability reports and published fixes will be reported as follows:
47
48- Issues will be entered into MCUboot's [security advisory
49  system](https://github.com/mcu-tools/mcuboot/security/advisories) on GitHub, with
50  the interested parties (including the reporter) added as viewers.
51
52- The release notes will contain a reference to any allocated CVE(s).
53
54- When the embargo is lifted, the security advisory page will be made
55  public, and the public CVE database will be updated with all
56  relevant information.
57