From 381c1fcd5528e6f67217d60306fd4c010e85fbd0 Mon Sep 17 00:00:00 2001 From: Luca Versari Date: Mon, 26 Oct 2026 20:19:59 +0100 Subject: [PATCH 1/2] Add security section to README Added security guidelines for reporting vulnerabilities in CMS. --- README.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/README.md b/README.md index 7cc87d639c..74b6acb128 100644 --- a/README.md +++ b/README.md @@ -77,3 +77,22 @@ find an updated list at . If you used CMS for a contest, selection, or a similar event, and want to publicize this information, we would be more than happy to hear from you and add it to that list. + +Security +-------- + +If you (or your agent) believe that you found a security vulnerability +in CMS, please follow these steps: + +1) Ensure that the security issue can actually be reproduced. +2) Check that the vulnerability is compatible with CMS's threat model. + In particular: + + - A "vulnerability" caused by a configuration key that explicitly + mentions needing modification is not a vulnerability. + - CMS assumes that the network that services will use for RPCs + is trusted. Anything that can be triggered by sending RPCs only + is not a vulnerability. + +4) If you did (1) and (2), please open a GitHub Security Advisory under + the "Security" tab. From 59ef8cbd474d5f777c618b9a169c09438b53f73d Mon Sep 17 00:00:00 2001 From: Luca Versari Date: Mon, 26 Oct 2026 20:20:27 +0100 Subject: [PATCH 2/2] Fix typo in README regarding GitHub Security Advisory --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 74b6acb128..98316a74eb 100644 --- a/README.md +++ b/README.md @@ -94,5 +94,5 @@ in CMS, please follow these steps: is trusted. Anything that can be triggered by sending RPCs only is not a vulnerability. -4) If you did (1) and (2), please open a GitHub Security Advisory under +3) If you did (1) and (2), please open a GitHub Security Advisory under the "Security" tab.