From f4974c995e771a8de62b01829ae9ed8c55e37241 Mon Sep 17 00:00:00 2001 From: Guilherme Soares Date: Tue, 19 Mar 2024 10:21:34 +0100 Subject: [PATCH 1/4] fix(codeQL): fixed code QL, updated to v2 --- .github/workflows/codeql-analysis.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 874ed3871..838db1db8 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,7 +29,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v1 + uses: github/codeql-action/init@v2 # Override language selection by uncommenting this and choosing your languages # with: # languages: go, javascript, csharp, python, cpp, java @@ -37,7 +37,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v1 + uses: github/codeql-action/autobuild@v2 # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -51,4 +51,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@v2 From 3ce85bdb63f20d48e788c5f986565dd40b6b3959 Mon Sep 17 00:00:00 2001 From: Guilherme Soares Date: Tue, 2 Apr 2024 09:49:27 +0200 Subject: [PATCH 2/4] feat: changed to v3 --- .github/workflows/codeql-analysis.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 838db1db8..814ac899c 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v3 with: # We must fetch at least the immediate parents so that if this is # a pull request then we can checkout the head. @@ -29,7 +29,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@v3 # Override language selection by uncommenting this and choosing your languages # with: # languages: go, javascript, csharp, python, cpp, java @@ -37,7 +37,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@v3 # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -51,4 +51,5 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@v3 + From 371de5e00460923528250937acf3ffea572204b0 Mon Sep 17 00:00:00 2001 From: Guilherme Soares Date: Tue, 2 Apr 2024 10:00:15 +0200 Subject: [PATCH 3/4] feat: give job permissions --- .github/workflows/codeql-analysis.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 814ac899c..80e30288d 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -13,6 +13,9 @@ jobs: analyze: name: Analyze runs-on: ubuntu-latest + permissions: + contents: read + security-events: write steps: - name: Checkout repository From b97de2d8a51c8d21ef0eb209e4cec6874d18729a Mon Sep 17 00:00:00 2001 From: Bernardo Codesido Date: Wed, 3 Apr 2024 15:18:20 -0300 Subject: [PATCH 4/4] fix: Update bug bounty program handler, domains and response times (#399) --- SECURITY.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index e5c3e2eeb..6ed424740 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,10 +1,10 @@ -# RSK's Security Process +# Token Bridge's Security Process We're committed to conduct our security process in a professional and civil manner. Public shaming, under-reporting or misrepresentation of vulnerabilities will not be tolerated. ## Responsible Disclosure -For all security related issues, RSK has to main points of contact. Reach us at or refer to our [Bug Bounty Program.](https://www.rsk.co/bounty-program/) **Do not open up a GitHub issue if the bug is a security vulnerability.** +For all security related issues, Token Bridge has to main points of contact. Reach us at or refer to our [Bug Bounty Program.](https://www.rootstocklabs.com/bug-bounty-program/) **Do not open up a GitHub issue if the bug is a security vulnerability.** **Ensure the bug was not already reported** by searching on Github under [Issues](https://github.com/rsksmart/tokenbridge/issues). @@ -12,10 +12,10 @@ For all security related issues, RSK has to main points of contact. Reach us at ### Response Time -RSK will make a best effort to meet the following response times for reported vulnerabilities: +RootstockLabs will make a best effort to meet the following response times for reported vulnerabilities: -* Time to first response (from report submit) - 24 hours -* Time to triage (from report submit) - 2 business days +* Time to first response (from report submit) - 5 business days +* Time to triage (from report submit) - 7 business days * Time to bounty (from triage) - 15 business days We’ll try to keep you informed about our progress throughout the process. @@ -23,9 +23,9 @@ We’ll try to keep you informed about our progress throughout the process. ### Disclouse Policy * Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines). -* Public disclosure of a vulnerability makes it ineligible for a bounty. If the user reports the vulnerability to other security teams (e.g. Ethereum or ETC) but reports to RSK with considerable delay, then RSK may reduce or cancel the bounty. +* Public disclosure of a vulnerability makes it ineligible for a bounty. -For more information check RSK bounty program policy at [HackerOne](https://hackerone.com/iovlabs) +For more information check RootstockLabs bounty program policy at [HackerOne](https://hackerone.com/rootstocklabs) ## Public Keys