From a006df7f0e946946d5333b1c9d7c2725b7e7f281 Mon Sep 17 00:00:00 2001 From: Philip Durbin Date: Tue, 21 Jul 2026 09:49:21 -0400 Subject: [PATCH 1/3] update security docs #12547 --- .../source/developers/security.md | 26 ++++++++++++++ .../source/developers/security.rst | 34 ------------------- .../source/installation/config.rst | 30 +++++++++++++--- 3 files changed, 51 insertions(+), 39 deletions(-) create mode 100644 doc/sphinx-guides/source/developers/security.md delete mode 100755 doc/sphinx-guides/source/developers/security.rst diff --git a/doc/sphinx-guides/source/developers/security.md b/doc/sphinx-guides/source/developers/security.md new file mode 100644 index 00000000000..4f733881149 --- /dev/null +++ b/doc/sphinx-guides/source/developers/security.md @@ -0,0 +1,26 @@ +# Security + +These are security resources for Dataverse developers. + +```{contents} +:local: +``` + +## User-Facing Security-Related Documentation + +You should familiarize yourself with the following content we provide for our users to read: + +- {ref}`ongoing-security` +- {ref}`security-advisories` +- {ref}`reporting-security-issues` +- [SECURITY.md](https://github.com/IQSS/dataverse/blob/develop/.github/SECURITY.md) (rendered for the public at ) + +Some information is repeated across these documents and we should keep them in sync. + +## Tracking Security Issues + +We use a private GitHub issue tracker at for security issues. + +## Sending Security Advisories + +See our [how to send a security advisory](https://docs.google.com/document/d/1sYhi-_U1xP2ZEjWtqVqkuuMxncG_VZZYQRKDEv6N-KQ/edit?usp=sharing) doc. \ No newline at end of file diff --git a/doc/sphinx-guides/source/developers/security.rst b/doc/sphinx-guides/source/developers/security.rst deleted file mode 100755 index 09b80a4c840..00000000000 --- a/doc/sphinx-guides/source/developers/security.rst +++ /dev/null @@ -1,34 +0,0 @@ -======== -Security -======== - -This section describes security practices and procedures for the Dataverse team. - -.. contents:: |toctitle| - :local: - -Intake of Security Issues -------------------------- - -As described under :ref:`reporting-security-issues`, we encourage the community to email security@dataverse.org if they have any security concerns. These emails go into our private ticket tracker (RT_). - -.. _RT: https://help.hmdc.harvard.edu - -We use a private GitHub issue tracker at https://github.com/IQSS/dataverse-security/issues for security issues. - -Sending Security Notices ------------------------- - -When drafting the security notice, it might be helpful to look at `previous examples`_. - -.. _previous examples: https://drive.google.com/drive/folders/0B_qMYwdHFZghaDZIU2hWQnBDZVE?resourcekey=0-SYjuhCohAIM7_pmysVc3Xg&usp=sharing - -Gather email addresses from the following sources (these are also described under :ref:`ongoing-security` in the Installation Guide): - -- "contact_email" in the `public installation spreadsheet`_ -- "Other Security Contacts" in the `private installation spreadsheet`_ - -Once you have the emails, include them as bcc. - -.. _public installation spreadsheet: https://docs.google.com/spreadsheets/d/1bfsw7gnHlHerLXuk7YprUT68liHfcaMxs1rFciA-mEo/edit#gid=0 -.. _private installation spreadsheet: https://docs.google.com/spreadsheets/d/1EWDwsj6eptQ7nEr-loLvdU7I6Tm2ljAplfNSVWR42i0/edit?usp=sharing diff --git a/doc/sphinx-guides/source/installation/config.rst b/doc/sphinx-guides/source/installation/config.rst index e9ad3bdfe24..e2aa4e11411 100644 --- a/doc/sphinx-guides/source/installation/config.rst +++ b/doc/sphinx-guides/source/installation/config.rst @@ -252,16 +252,34 @@ For any resources to be integrated with Dataverse, find documentation how to set Ongoing Security of Your Installation +++++++++++++++++++++++++++++++++++++ -Like any application, you should keep up-to-date with patches to both the Dataverse software and the platform (usually Linux) it runs on. Dataverse releases are announced on the dataverse-community_ mailing list, the Dataverse blog_, and in chat.dataverse.org_. +New Releases +^^^^^^^^^^^^ + +Like any application, you should keep up-to-date with new releases of Dataverse, which often contain security fixes. + +Dataverse releases are announced on the dataverse-community_ mailing list, Zulip_, and the Dataverse blog_. .. _dataverse-community: https://groups.google.com/g/dataverse-community +.. _Zulip: https://dataverse.zulipchat.com/ .. _blog: https://dataverse.org/blog -.. _chat.dataverse.org: https://chat.dataverse.org -In addition to these public channels, you can subscribe to receive security notices via email from the Dataverse team. These notices are sent to the ``contact_email`` in the installation spreadsheet_ and you can open an issue in the dataverse-installations_ repo to add or change the contact email. Security notices are also sent to people and organizations that prefer to remain anonymous. To be added to this private list, please email support@dataverse.org. +These announcements link to release notes, which can be found on GitHub: + +- Backend: https://github.com/IQSS/dataverse/releases +- Frontend: https://github.com/IQSS/dataverse-frontend/releases + +If the release contains a security-related fix, the release notes will mention generically that a fix is included. Some details are provided via private security advisories, described below. + +.. _security-advisories: -.. _spreadsheet: https://docs.google.com/spreadsheets/d/1bfsw7gnHlHerLXuk7YprUT68liHfcaMxs1rFciA-mEo/edit#gid=0 -.. _dataverse-installations: https://github.com/IQSS/dataverse-installations +Security Advisories +^^^^^^^^^^^^^^^^^^^ + +We highly recommend signing up to receive security advisories from the Dataverse team. These advisories are not archived publicly because we don't want attackers to use exploits against you. For this reason we also control who is subscribed to the security advisory mailing list. + +To subscribe, email support@dataverse.org and ask to be added to the Dataverse security advisory mailing list. + +Below you'll see a step called :ref:`map-of-installations` where you can provide a email address we can use to contact you. We typically automatically add this address to the security list but please feel free to reach out early. For additional details about security practices by the Dataverse team, see the :doc:`/developers/security` section of the Developer Guide. @@ -2572,6 +2590,8 @@ One way to submit your sitemap URL to Google is by using their "Search Console" .. _Google's "submit a sitemap" instructions: https://support.google.com/webmasters/answer/183668 +.. _map-of-installations: + Putting Your Dataverse Installation on the Map at dataverse.org +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From 3ffdd39d1abd6512cbbf3e5ea64a2d3769ca3e30 Mon Sep 17 00:00:00 2001 From: Philip Durbin Date: Mon, 27 Jul 2026 10:45:42 -0400 Subject: [PATCH 2/3] we give credit to security researchers in release notes #12547 --- .github/SECURITY.md | 2 ++ doc/sphinx-guides/source/developers/making-releases.rst | 1 + doc/sphinx-guides/source/installation/config.rst | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/SECURITY.md b/.github/SECURITY.md index c36e26c8330..1641b9301b9 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -2,6 +2,8 @@ To report a security vulnerability please email security@dataverse.org as explained at https://guides.dataverse.org/en/latest/installation/config.html#reporting-security-issues +We usually give credit to security researchers in our release notes. + Advice on securing your installation can be found at https://guides.dataverse.org/en/latest/installation/config.html#securing-your-installation Security practices and procedures used by the Dataverse team are described at https://guides.dataverse.org/en/latest/developers/security.html diff --git a/doc/sphinx-guides/source/developers/making-releases.rst b/doc/sphinx-guides/source/developers/making-releases.rst index a61a171cdf3..b5da71f787a 100755 --- a/doc/sphinx-guides/source/developers/making-releases.rst +++ b/doc/sphinx-guides/source/developers/making-releases.rst @@ -96,6 +96,7 @@ The task at or near release time is to collect these snippets into a single file - Create a branch, add a .md file for the release (ex. 6.10.1 Release Notes) in ``/doc/release-notes`` and write the release notes, making sure to pull content from the release note snippets mentioned above. Snippets may not include any issue number or pull request number in the text so be sure to copy the number from the filename of the snippet into the final release note. - Delete (``git rm``) the release note snippets as the content is added to the main release notes file. - Include instructions describing the steps required to upgrade the application from the previous version. These must be customized for release numbers and special circumstances such as changes to metadata blocks and infrastructure. These instructions are required for the next steps (deploying to various environments) so try to prioritize them over finding just the right words in release highlights (which you can do later). +- We usually include a "Security Updates" section due to dependencies we've updated. Under that section, give credit to any security researchers who have reported vulnerabilities. In the `6.11 release notes `_, for example, we wrote "We would like to thank [person1], [person2], and [person3] for notifying us about vulnerabilities that were fixed in this release." See also :ref:`reporting-security-issues`. - Make a pull request. Here's an example: https://github.com/IQSS/dataverse/pull/11613 - Note that we won't merge the release notes until after we have confirmed that the upgrade instructions are valid by performing a couple upgrades. diff --git a/doc/sphinx-guides/source/installation/config.rst b/doc/sphinx-guides/source/installation/config.rst index e2aa4e11411..9ce5b451100 100644 --- a/doc/sphinx-guides/source/installation/config.rst +++ b/doc/sphinx-guides/source/installation/config.rst @@ -288,7 +288,7 @@ For additional details about security practices by the Dataverse team, see the : Reporting Security Issues +++++++++++++++++++++++++ -If you have a security issue to report, please email it to security@dataverse.org. +If you have a security issue to report, please email it to security@dataverse.org. We usually give credit to security researchers in our release notes. We expect security researchers to look for this information in SECURITY.md (:download:`plain-text <../../../../.github/SECURITY.md>`, `HTML `_) and include it there. .. _network-ports: From 71dd86bd95d728f022266cdbd03a4003e1040ffe Mon Sep 17 00:00:00 2001 From: Philip Durbin Date: Mon, 27 Jul 2026 11:22:33 -0400 Subject: [PATCH 3/3] add section on giving credit #12547 --- doc/sphinx-guides/source/developers/making-releases.rst | 2 +- doc/sphinx-guides/source/developers/security.md | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/doc/sphinx-guides/source/developers/making-releases.rst b/doc/sphinx-guides/source/developers/making-releases.rst index b5da71f787a..2d8ee842e83 100755 --- a/doc/sphinx-guides/source/developers/making-releases.rst +++ b/doc/sphinx-guides/source/developers/making-releases.rst @@ -96,7 +96,7 @@ The task at or near release time is to collect these snippets into a single file - Create a branch, add a .md file for the release (ex. 6.10.1 Release Notes) in ``/doc/release-notes`` and write the release notes, making sure to pull content from the release note snippets mentioned above. Snippets may not include any issue number or pull request number in the text so be sure to copy the number from the filename of the snippet into the final release note. - Delete (``git rm``) the release note snippets as the content is added to the main release notes file. - Include instructions describing the steps required to upgrade the application from the previous version. These must be customized for release numbers and special circumstances such as changes to metadata blocks and infrastructure. These instructions are required for the next steps (deploying to various environments) so try to prioritize them over finding just the right words in release highlights (which you can do later). -- We usually include a "Security Updates" section due to dependencies we've updated. Under that section, give credit to any security researchers who have reported vulnerabilities. In the `6.11 release notes `_, for example, we wrote "We would like to thank [person1], [person2], and [person3] for notifying us about vulnerabilities that were fixed in this release." See also :ref:`reporting-security-issues`. +- We usually include a "Security Updates" section due to dependencies we've updated. Under that section, give credit to any security researchers who have reported vulnerabilities. In the `6.11 release notes `_, for example, we wrote "We would like to thank [person1], [person2], and [person3] for notifying us about vulnerabilities that were fixed in this release." See :ref:`security-researcher-credit` and :ref:`reporting-security-issues`. - Make a pull request. Here's an example: https://github.com/IQSS/dataverse/pull/11613 - Note that we won't merge the release notes until after we have confirmed that the upgrade instructions are valid by performing a couple upgrades. diff --git a/doc/sphinx-guides/source/developers/security.md b/doc/sphinx-guides/source/developers/security.md index 4f733881149..9deb6d633b0 100644 --- a/doc/sphinx-guides/source/developers/security.md +++ b/doc/sphinx-guides/source/developers/security.md @@ -23,4 +23,9 @@ We use a private GitHub issue tracker at