mirror of
git://code.qt.io/qt/qt5.git
synced 2026-10-17 12:27:11 +08:00
Alexei Cazacov
7e2b6df4a8
This commit introduces the following changes: - README.md - Updated, completely rewritten. Now includes up-to-date information. - README.git - Deleted. - SECURITY.md - A new document that points to QUIP 15. - CODE_OF_CONDUCT.md - A new document that points to QUIP 12. - GOVERNANCE.md - A new document that points to QUIP 2. - CHANGELOG.md - A new document that points to what's new pages, release wiki pages, porting guide, dist/ deprecation note. - LICENSE.md - A new document that explains where per-module terms live. - README.md.template - Updated, to specify its purpose. Fixes: QTBUG-149126 Pick-to: 6.12 6.12.0 Change-Id: I2d2385e22769d4df360a626abc7484baf1cb0285 Reviewed-by: Kai Köhne <[email protected]>
1.8 KiB
1.8 KiB
Security policy
Reporting a vulnerability
Report suspected security vulnerabilities in Qt by email to [email protected]. Do not report them in the public bug tracker at bugreports.qt.io.
If you hold a commercial license, you can instead report the issue to the Qt Company support team through the support portal, using the "Security Issues" category.
The policy
QUIP 15 is the Qt Project Security Policy. It is the authoritative source for how the project handles security issues, and it covers:
- How reports are received, acknowledged, and triaged, and in what time frame.
- Who is responsible for addressing an issue, and how it is escalated.
- How issues are disclosed, including CVE handling and notification of packagers.
- Which versions of Qt fixes are guaranteed for.
Security announcements are published to the announce mailing list.
Qt customers with a commercial license now have the opportunity to subscribe to the Qt Early Warning List in the Customer Portal. The EWL subscription requires an active Commercial Qt license.
Related material
- Security in Qt — what Qt does and does not protect against, and how to use Qt securely.
- QUIP 23 — the
Qt-Securityheader that marks how security-relevant a source file is. - QUIP 16 — the branch policy, which governs which branches accept which changes.
- Responsible Vulnerability Disclosure Agreement - Terms and Conditions of Responsible Vulnerability Disclosure Process at Qt Group.