|
2 | 2 |
|
3 | 3 | ## Security
|
4 | 4 |
|
5 |
| -Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/). |
| 5 | +Microsoft takes the security of our software products and services seriously, which includes all |
| 6 | +source code repositories managed through our GitHub organizations, which include [Microsoft][10], |
| 7 | +[Azure][08], [DotNet][09], [AspNet][07], [Xamarin][11], and [our GitHub organizations][12]. |
6 | 8 |
|
7 |
| -If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/opensource/security/definition), please report it to us as described below. |
| 9 | +If you believe you have found a security vulnerability in any Microsoft-owned repository that meets |
| 10 | +[Microsoft's definition of a security vulnerability][04], please report it to us as described below. |
8 | 11 |
|
9 | 12 | ## Reporting Security Issues
|
10 | 13 |
|
11 | 14 | **Please do not report security vulnerabilities through public GitHub issues.**
|
12 | 15 |
|
13 |
| -Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/opensource/security/create-report). |
| 16 | +Instead, please report them to the Microsoft Security Response Center (MSRC) at |
| 17 | +[https://msrc.microsoft.com/create-report][02]. |
14 | 18 |
|
15 |
| -If you prefer to submit without logging in, send email to [[email protected]](mailto:[email protected]). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page ](https://aka.ms/opensource/security/pgpkey). |
| 19 | +If you prefer to submit without logging in, send email to [[email protected]][13]. If possible, |
| 20 | +encrypt your message with our PGP key; please download it from the |
| 21 | +[Microsoft Security Response Center PGP Key page][06]. |
16 | 22 |
|
17 |
| -You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://aka.ms/opensource/security/msrc). |
| 23 | +You should receive a response within 24 hours. If for some reason you do not, please follow up via |
| 24 | +email to ensure we received your original message. Additional information can be found at |
| 25 | +[microsoft.com/msrc][05]. |
18 | 26 |
|
19 |
| -Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue: |
| 27 | +Please include the requested information listed below (as much as you can provide) to help us better |
| 28 | +understand the nature and scope of the possible issue: |
20 | 29 |
|
21 |
| - * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) |
22 |
| - * Full paths of source file(s) related to the manifestation of the issue |
23 |
| - * The location of the affected source code (tag/branch/commit or direct URL) |
24 |
| - * Any special configuration required to reproduce the issue |
25 |
| - * Step-by-step instructions to reproduce the issue |
26 |
| - * Proof-of-concept or exploit code (if possible) |
27 |
| - * Impact of the issue, including how an attacker might exploit the issue |
| 30 | +- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) |
| 31 | +- Full paths of source file(s) related to the manifestation of the issue |
| 32 | +- The location of the affected source code (tag/branch/commit or direct URL) |
| 33 | +- Any special configuration required to reproduce the issue |
| 34 | +- Step-by-step instructions to reproduce the issue |
| 35 | +- Proof-of-concept or exploit code (if possible) |
| 36 | +- Impact of the issue, including how an attacker might exploit the issue |
28 | 37 |
|
29 | 38 | This information will help us triage your report more quickly.
|
30 | 39 |
|
31 |
| -If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/opensource/security/bounty) page for more details about our active programs. |
| 40 | +If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty |
| 41 | +award. Please visit our [Microsoft Bug Bounty Program][01] page for more details about our active |
| 42 | +programs. |
32 | 43 |
|
33 | 44 | ## Preferred Languages
|
34 | 45 |
|
35 | 46 | We prefer all communications to be in English.
|
36 | 47 |
|
37 | 48 | ## Policy
|
38 | 49 |
|
39 |
| -Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd). |
| 50 | +Microsoft follows the principle of [Coordinated Vulnerability Disclosure][03]. |
40 | 51 |
|
41 | 52 | <!-- END MICROSOFT SECURITY.MD BLOCK -->
|
| 53 | +<!-- link references --> |
| 54 | +[01]: https://aka.ms/opensource/security/bounty |
| 55 | +[02]: https://aka.ms/opensource/security/create-report |
| 56 | +[03]: https://aka.ms/opensource/security/cvd |
| 57 | +[04]: https://aka.ms/opensource/security/definition |
| 58 | +[05]: https://aka.ms/opensource/security/msrc |
| 59 | +[06]: https://aka.ms/opensource/security/pgpkey |
| 60 | +[07]: https://github.com/aspnet |
| 61 | +[08]: https://github.com/Azure |
| 62 | +[09]: https://github.com/dotnet |
| 63 | +[10]: https://github.com/microsoft |
| 64 | +[11]: https://github.com/xamarin |
| 65 | +[12]: https://opensource.microsoft.com/ |
| 66 | + |
0 commit comments