From 118a96b300b8d5a138b50fe5ea4423613001fd60 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20Quenaudon?= Date: Wed, 16 Sep 2026 16:58:33 +0100 Subject: [PATCH 1/2] Move the security policy to SECURITY.md at the repository root GitHub surfaces a security policy only from the repository root, from .github/, or from docs/SECURITY.md with that exact capitalisation. The community profile for this repository reports no security policy today, so the file at docs/security.md is invisible to GitHub. --- docs/security.md => SECURITY.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename docs/security.md => SECURITY.md (100%) diff --git a/docs/security.md b/SECURITY.md similarity index 100% rename from docs/security.md rename to SECURITY.md From 2bd444e4617305e22c51fbc4f8bd6b30c5e73a23 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20Quenaudon?= Date: Wed, 16 Sep 2026 16:58:33 +0100 Subject: [PATCH 2/2] Update the security policy content Update the supported versions table. Add a threat model section. The section states that a .proto schema is source code, and that code generated from an untrusted schema carries supply chain risk. --- SECURITY.md | 40 ++++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 70c60b8ed6..32553bd405 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,21 +1,33 @@ -Security Policy -=============== +# Security Policy ## Supported Versions -| Version | Supported | -|---------| ---------- | -| 4.x | ✅ | -| 3.x | ✅ | -| 2.x | | -| 1.x | | - +| Version | Supported | +|---------|-----------| +| 7.0.x | ✅ | +| 6.4.x | ✅ | +| 5.x | | +| 4.x | | +| 3.x | | ## Reporting a Vulnerability -Square recognizes the important contributions the security research community -can make. We therefore encourage reporting security issues with the code -contained in this repository. +Square recognizes the important contributions the security research community can make. We therefore encourage reporting security issues with the code contained in this repository. + +If you believe you have discovered a security vulnerability, please follow the guidelines at https://bugcrowd.com/squareopensource. + +## Threat Model + +Wire generates source code from `.proto` schema files. Treat a `.proto` file as source code, in the same way you would treat a `.java`, `.kt` or `.swift` file in your build. + +A schema controls the shape of the code that Wire emits. Compiling and running code generated from a schema you do not trust carries the same supply chain risk as compiling and running any other third party source code. This is not specific to Wire. The reference implementation states the same position for `protoc` in its own security policy: https://github.com/protocolbuffers/protobuf/blob/main/SECURITY.md. + +In practice this means: + +- Review schemas that arrive from outside your organisation, including vendored copies and schemas pulled from a shared registry, with the same care you apply to third party source code. +- Do not build or run generated code from an untrusted schema without that review. +- Prefer pinned, reviewed schema sources over schemas fetched at build time. + +Wire validates schema input where validation is cheap and unambiguous. Option values that reach generated source, such as `java_package` and `wire.wire_package`, are checked before they are emitted. This validation is defence in depth. It is not a substitute for trusting the source of your schemas. -If you believe you have discovered a security vulnerability, please follow the -guidelines at https://bugcrowd.com/squareopensource +If you find a way to make Wire emit code that a schema author should not be able to produce, we want to hear about it. Report it through the channel above, whether or not it fits the guidance in this section.