Update SECURITY policy to conform to ASF guidelines - #2601
Merged
Merged
Conversation
Follow the ASF security reporting process (security@apache.org) instead of a personal email address, and document what is considered a security vulnerability vs. a bug, modeled on arrow-rs's SECURITY.md. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
alamb
marked this pull request as ready for review
September 30, 2026 19:42
alamb
changed the title
alamb
commented
Sep 30, 2026
| string from a user or external system). The parser is expected to reject invalid | ||
| or malformed SQL with an error. | ||
|
|
||
| Unexpected behavior triggered by malformed or adversarial input is generally |
Contributor
Author
There was a problem hiding this comment.
This very much follows the arrow-rs model -- I am not sure we need to expand the scope for SQLParser but am open to suggestions
This was referenced Sep 30, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2601 +/- ##
=======================================
Coverage 81.09% 81.09%
=======================================
Files 42 42
Lines 33684 33684
Branches 33684 33684
=======================================
Hits 27316 27316
Misses 2798 2798
Partials 3570 3570 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
adriangb
approved these changes
Sep 30, 2026
LucaCappelletti94
approved these changes
Oct 1, 2026
Contributor
|
@alamb merging |
Contributor
Author
|
Nice -- thanks @LucaCappelletti94 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's not working
Our
SECURITY.mdlists my personal email as the security contact and doesn't follow ASF guidelines or explain what counts as a security vulnerability vs. a regular bug.Fix
Update
SECURITY.md, modeled on arrow-rs's SECURITY.md: https://github.com/apache/arrow-rs/blob/main/SECURITY.md