From 40511b3929db59449e36b79e86b6b4f5de993685 Mon Sep 17 00:00:00 2001 From: Lee Rhodes Date: Fri, 9 Oct 2026 17:45:35 -0700 Subject: [PATCH 1/2] Add SECURITY.md Describes how to report a vulnerability privately, the supported-versions policy, where published vulnerabilities are listed, and the security model for deserialization and the other APIs. Excluded from the RAT audit like the other top-level documentation files. Co-Authored-By: Claude Opus 5.5 --- .rat-excludes | 1 + SECURITY.md | 63 +++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) create mode 100644 SECURITY.md diff --git a/.rat-excludes b/.rat-excludes index 3c5bcd39..2f52a677 100644 --- a/.rat-excludes +++ b/.rat-excludes @@ -16,6 +16,7 @@ fdlibm_log\.hpp README\.md CONTRIBUTING\.md CODE_OF_CONDUCT\.md +SECURITY\.md # # Generated and template files consumed by the build. Doxyfile diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..2c96862f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,63 @@ +# Security Policy + +## Reporting a Vulnerability + +Please do not report security vulnerabilities through public GitHub +issues, pull requests or mailing lists. + +Report them privately to the Apache Security Team at +security@apache.org, or to the Apache DataSketches PMC at +private@datasketches.apache.org. The Apache Security Team forwards +reports to the PMC and coordinates the process described at +https://www.apache.org/security/. + +Please include the affected version, a description of the issue and, if +possible, a way to reproduce it (for example, a serialized sketch that +triggers it). + +## Supported Versions + +The Apache DataSketches PMC supports only the latest release. Security +fixes are made in the next release and are not backported to earlier +releases. Users should upgrade to the latest release to receive fixes. + +## Published Vulnerabilities + +Published vulnerabilities and their advisories are listed at +https://datasketches.apache.org/docs/Community/Security.html. + +## Security Model + +### Deserialization + +The deserialization functions of all sketches (the `deserialize()` and +`wrap()` functions that take a byte buffer or a stream) must be safe to +call on arbitrary input, including input crafted by an attacker. A +malformed, truncated or corrupt serialized sketch must be rejected with +an exception, such as `std::invalid_argument`, `std::out_of_range` or +`std::runtime_error`. It must never cause an out-of-bounds read or write, +or other undefined behavior. + +A failure to meet this is treated as a security vulnerability. + +Applications that deserialize sketches from untrusted sources should +catch these exceptions. Note that a well-formed sketch can legitimately +be large. Applications that accept sketches from untrusted sources +should limit the size of the input they accept. + +### Other APIs + +Other APIs, such as sketch construction parameters, updates, merges and +queries, assume a caller that follows the documented preconditions. For +example, sketch sizes must be within the documented limits, and a +sketch must not be used concurrently from multiple threads without +external synchronization. Violating a documented precondition is a bug +in the calling application, not a vulnerability in this library. + +### Estimates + +Sketches produce approximate results with probabilistic error bounds. +An adversary who controls the input data can bias the estimates, for +example by choosing items that hash to specific values when the hash +seed is known. This is inherent to sketching and is not a vulnerability. +Applications where this matters should use a secret, non-default seed. From f4cd158d0acd30d19962ef63565fc4ed76975c04 Mon Sep 17 00:00:00 2001 From: Lee Rhodes Date: Fri, 9 Oct 2026 17:48:49 -0700 Subject: [PATCH 2/2] SECURITY.md: add the ASF license header instead of excluding it from RAT Co-Authored-By: Claude Opus 5.5 --- .rat-excludes | 1 - SECURITY.md | 19 +++++++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/.rat-excludes b/.rat-excludes index 2f52a677..3c5bcd39 100644 --- a/.rat-excludes +++ b/.rat-excludes @@ -16,7 +16,6 @@ fdlibm_log\.hpp README\.md CONTRIBUTING\.md CODE_OF_CONDUCT\.md -SECURITY\.md # # Generated and template files consumed by the build. Doxyfile diff --git a/SECURITY.md b/SECURITY.md index 2c96862f..1ac1c7b5 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,22 @@ + + # Security Policy ## Reporting a Vulnerability