Skip to content

doc: clarify experimental platform vulnerability policy #59591

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 25, 2025
Merged

doc: clarify experimental platform vulnerability policy #59591

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3b681fb
doc: clarify experimental platform vulnerability policy
mcollina Aug 23, 2025
2316c27
Update SECURITY.md
mcollina Aug 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
doc: clarify experimental platform vulnerability policy 
Adds a new section to the threat model specifying that security
vulnerabilities affecting only experimental platforms will not be
accepted as valid security issues and will be treated as normal bugs.

This clarifies that experimental OS/hardware combinations do not
qualify for CVEs or bug bounty rewards, aligning with their limited
testing and support infrastructure.

Signed-off-by: Matteo Collina <[email protected]>
  • Loading branch information
@mcollina
mcollina committed Aug 23, 2025
commit 3b681fb65556fcb86c37d66e6675b1fb7d255ecd
16 changes: 16 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,22 @@ vulnerability in the context of the Node.js threat model. In other
words, it cannot assume that a trusted element (such as the operating
system) has been compromised.

### Experimental platforms

Node.js maintains a tier-based support system for operating systems and
hardware combinations (Tier 1, Tier 2, and Experimental). For platforms
classified as "Experimental" in the [supported platforms](BUILDING.md#supported-platforms)
documentation:

* Security vulnerabilities will **not** be accepted as valid security issues
* Problems on experimental platforms will be treated as normal bugs
* No CVEs will be issued for issues that only affect experimental platforms
* Bug bounty rewards are not available for experimental platform-specific issues

This policy recognizes that experimental platforms may not compile, may not
pass the test suite, and do not have the same level of testing and support
infrastructure as Tier 1 and Tier 2 platforms.

Being able to cause the following through control of the elements that Node.js
does not trust is considered a vulnerability:

Expand Down
Loading