The following table outlines the versions of OpenSearch Index Manager that are currently supported with security updates:

• Active Support: Receive all security updates and bug fixes
• Maintenance Support: Receive critical security updates only
• End of Life: No longer receiving updates

We take security seriously. If you discover a security vulnerability, please report it responsibly.

Please DO NOT report security vulnerabilities through public GitHub issues.

Instead, please report security vulnerabilities via one of the following methods:

1. Email: Send details to security@opensearch.org
2. Private GitHub Advisory: Create a private security advisory

When reporting a vulnerability, please include:

• Description: Clear description of the vulnerability
• Steps to Reproduce: Detailed steps to reproduce the issue
• Impact: Assessment of the potential impact
• Affected Versions: Which versions are affected
• Mitigation: Any known workarounds or mitigations
• Proof of Concept: If available, provide a proof of concept (without exploiting real data)

Subject: Security Vulnerability Report - [Brief Description]

## Summary
Brief summary of the vulnerability

## Affected Component
- Plugin Version: [e.g., 1.0.0]
- OpenSearch Dashboards Version: [e.g., 2.19.0]
- Component: [e.g., Document API, UI Component]

## Steps to Reproduce
1. Step one
2. Step two
3. Step three

## Impact
Description of what an attacker could achieve

## Severity Assessment
- [ ] Critical - System compromise, data breach
- [ ] High - Significant security impact
- [ ] Medium - Limited security impact
- [ ] Low - Minor security issue

## Mitigation
Any known workarounds

## Additional Information
Any other relevant details

1. Acknowledgment: You will receive an acknowledgment within 48 hours
2. Assessment: We will assess the report and assign a severity level
3. Updates: We will provide regular updates on our progress
4. Coordination: We will coordinate disclosure timeline with you
5. Credit: We will credit you in the security advisory (unless you prefer anonymity)

Security patches are released as:

• Emergency Releases: For critical vulnerabilities (within 7 days)
• Regular Security Updates: For high/medium severity (next scheduled release)
• Bundled Fixes: For low severity (included in regular releases)

Security updates are announced through:

• GitHub Security Advisories
• GitHub Releases (marked as security releases)
• Mailing list: security-announce@lists.opensearch.org

1. Keep Updated: Always use the latest supported version
2. Monitor: Subscribe to security advisories
3. Network Security: Run OSD behind a firewall/reverse proxy
4. Access Control: Use OpenSearch Security for authentication/authorization
5. Audit Logging: Enable audit logging for security events

1. Input Validation: Always validate user inputs
2. Output Encoding: Properly encode outputs to prevent XSS
3. Least Privilege: Use minimal required permissions
4. Dependencies: Keep dependencies updated
5. Security Testing: Include security tests in CI/CD

None currently.

The plugin implements the following security features:

• All API inputs are validated against schemas
• SQL injection prevention
• XSS prevention through output encoding
• CSRF protection through OSD framework

• Relies on OSD authentication
• Respects OpenSearch Security permissions
• No direct credential storage

• No sensitive data logging
• Error messages don't leak internal details
• Configurable through OSD security settings

The following security tests are run in CI/CD:

• Dependency vulnerability scanning (Dependabot, Snyk)
• Static Application Security Testing (SAST)
• Secret scanning
• Container image scanning

This project aims to comply with:

• OWASP Top 10
• CWE Top 25
• OpenSearch Security Best Practices

None currently.

For security-related questions (not vulnerability reports):

• Security Team: security@opensearch.org
• General Inquiries: Discussions

We thank the following security researchers for their responsible disclosures:

• None yet - be the first!

This security policy is subject to change. Last updated: 2024.