Skip to content

Commit 7a19bb4

Browse files
cardernecarderne
authored
chore: add security docs (#4192)
Adds SECURITY.md and security page to the docs.
1 parent 80d4819 commit 7a19bb4

5 files changed

Lines changed: 106 additions & 1 deletion

File tree

‎SECURITY.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Security Policy
2+
3+
We take the security of Trigger.dev seriously — for both our Cloud service and self-hosted deployments. This document explains how to report a vulnerability and what to expect from us.
4+
5+
## Reporting a vulnerability
6+
7+
**Please do not report security vulnerabilities through public GitHub issues, pull requests, or our Discord.**
8+
9+
Use one of these private channels instead:
10+
11+
1. **GitHub (preferred):** Open a private report from the repository's **Security** tab — click **"Report a vulnerability"** ([direct link](https://github.com/triggerdotdev/trigger.dev/security/advisories/new)).
12+
2. **Email:** `security-advisories@trigger.dev`
13+
14+
Please include as much of the following as you can:
15+
16+
- A description of the vulnerability and its impact
17+
- Steps to reproduce, ideally with a proof of concept
18+
- Affected version(s) and component(s)
19+
- Any suggested remediation
20+
21+
If you report by email, we will open a private GitHub Security Advisory to track the issue. All reports — however they reach us — are tracked there.
22+
23+
## What to expect
24+
25+
| Stage | Target |
26+
| --- | --- |
27+
| Acknowledgement of your report | within 3 business days |
28+
| Validation and severity assessment (CVSS 3.1) | within 1 week |
29+
30+
We assess severity using CVSS 3.1 and prioritise remediation accordingly:
31+
32+
| Severity (CVSS 3.1) | Target time to resolve |
33+
| --- | --- |
34+
| Critical (9.0–10.0) | 7 days |
35+
| High (7.0–8.9) | 30 days |
36+
| Medium (4.0–6.9) | 90 days |
37+
| Low (0.1–3.9) | As needed |
38+
39+
These are best-effort targets, measured from the point we validate and accept a report — not guarantees. Real-world exploitability may lead us to escalate an issue beyond its base score.
40+
41+
## Coordinated disclosure
42+
43+
We follow coordinated disclosure. Please give us a reasonable opportunity to investigate and ship a fix before any public disclosure. Our default disclosure window is 90 days from acceptance, though we aim to resolve issues sooner.
44+
45+
Once a fix is released we publish a GitHub Security Advisory (and request a CVE where applicable), and we credit reporters unless you ask to remain anonymous.
46+
47+
## Supported versions
48+
49+
We patch the **latest released version line** only. Self-hosters should run the latest version-tagged release to receive security fixes. See the [self-hosting documentation](https://trigger.dev/docs/self-hosting/overview).

‎docs/docs.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,7 @@
282282
"self-hosting/overview",
283283
"self-hosting/docker",
284284
"self-hosting/kubernetes",
285+
"self-hosting/security",
285286
{
286287
"group": "Environment variables",
287288
"pages": ["self-hosting/env/webapp", "self-hosting/env/supervisor"]

‎docs/self-hosting/docker.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,8 @@ By default, the images will point at the latest versioned release via the `lates
342342
TRIGGER_IMAGE_TAG=v4.5.0
343343
```
344344
345+
We patch the latest released version line only, so keep an eye on new releases to receive security fixes. See [Security & vulnerability reporting](/self-hosting/security).
346+
345347
## Task events
346348
347349
By default, task events (timeline, logs, spans) are stored in PostgreSQL. For production deployments we recommend storing them in ClickHouse instead, it scales to much higher volumes and avoids unbounded growth of the `TaskEvent` table.

‎docs/self-hosting/overview.mdx‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ description: "You can self-host Trigger.dev on your own infrastructure."
66

77
Self-hosting Trigger.dev means you run and manage the platform on your own infrastructure, giving you full control over your environment, deployment process, and the URLs you expose the service on.
88

9-
You are responsible for provisioning resources, handling updates, and managing any security, scaling or reliability challenges that arise.
9+
You are responsible for provisioning resources, handling updates, and managing any security, scaling or reliability challenges that arise. See [Security & vulnerability reporting](/self-hosting/security) for how to report issues and stay informed about security releases.
1010

1111
We provide version-tagged releases for self-hosted deployments. It's highly advised to use these tags exclusively and keep them locked with your CLI version.
1212

@@ -106,4 +106,7 @@ It's dangerous to go alone! Join the self-hosting channel on our [Discord server
106106
<Card title="Kubernetes" color="#326CE5" icon="dharmachakra" href="/self-hosting/kubernetes">
107107
Learn how to self-host Trigger.dev with Kubernetes.
108108
</Card>
109+
<Card title="Security" icon="shield-halved" href="/self-hosting/security">
110+
Report vulnerabilities and stay informed about security releases.
111+
</Card>
109112
</CardGroup>

‎docs/self-hosting/security.mdx‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
title: "Security & vulnerability reporting"
3+
description: "How to report security issues in Trigger.dev, our response targets, and how self-hosters receive security notices."
4+
sidebarTitle: "Security"
5+
---
6+
7+
We take the security of Trigger.dev seriously, for both Cloud and self-hosted deployments. This page covers how to report a vulnerability, what to expect, and how to stay informed about security releases.
8+
9+
<Warning>
10+
Do not report security vulnerabilities through public GitHub issues, pull requests, or Discord. Use one of the private channels below.
11+
</Warning>
12+
13+
## Reporting a vulnerability
14+
15+
<Steps>
16+
<Step title="Choose a private channel">
17+
- **GitHub (preferred):** open a private report from the repository's **Security** tab using **"Report a vulnerability"** ([direct link](https://github.com/triggerdotdev/trigger.dev/security/advisories/new)).
18+
- **Email:** `security-advisories@trigger.dev`
19+
</Step>
20+
<Step title="Include the details">
21+
A description and impact, steps to reproduce (a proof of concept helps), affected versions/components, and any suggested fix.
22+
</Step>
23+
<Step title="We track it privately">
24+
Every report is tracked in a private GitHub Security Advisory. If you email us, we open the advisory on your behalf.
25+
</Step>
26+
</Steps>
27+
28+
## What to expect
29+
30+
| Stage | Target |
31+
| --- | --- |
32+
| Acknowledgement | within 3 business days |
33+
| Validation + CVSS 3.1 severity assessment | within 1 week |
34+
35+
We score issues with CVSS 3.1 and prioritise remediation by severity:
36+
37+
| Severity (CVSS 3.1) | Target time to resolve |
38+
| --- | --- |
39+
| Critical (9.0–10.0) | 7 days |
40+
| High (7.0–8.9) | 30 days |
41+
| Medium (4.0–6.9) | 90 days |
42+
| Low (0.1–3.9) | As needed |
43+
44+
<Note>
45+
These are best-effort targets measured from when we validate and accept a report, not guarantees. We follow coordinated disclosure with a default 90-day window, and publish a GitHub Security Advisory (requesting a CVE where applicable) once a fix ships.
46+
</Note>
47+
48+
## Supported versions
49+
50+
We patch the **latest released version line** only. Run the latest version-tagged release to receive security fixes — see [Self-hosting overview](/self-hosting/overview).

0 commit comments

Comments
 (0)