docs: add SECURITY.md for private vulnerability reporting - #5493
Open
Solaris-star wants to merge 1 commit into
Open
docs: add SECURITY.md for private vulnerability reporting#5493Solaris-star wants to merge 1 commit into
Solaris-star wants to merge 1 commit into
Conversation
Provide a clear private disclosure path so researchers are not forced to file public issues. Prefer GitHub private reporting or the project Telegram group for maintainer contact. Fixes chatchat-space#5492 Signed-off-by: Solaris-star <820622658@qq.com>
dosubot
Bot
added
the
size:M
|
Flagging some urgency: the issue that we are about to report is critical, and there's still no private channel to finalize an advisory through. It would help a lot if you could merge this PR and enable Private Vulnerability Reporting (Settings → Code security and analysis → Private vulnerability reporting) so the full report and a CVE can be handled properly. One small suggestion for the SECURITY.md itself: alongside the GitHub private-reporting link, listing a security contact email as a fallback would make it easier for researchers to reach you even before PVR is on. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Researchers currently have no documented private security contact (
SECURITY.mdmissing; private vulnerability reporting not obvious). This adds a rootSECURITY.mddescribing supported versions and private disclosure channels so vulnerabilities are not filed as public issues.Testing
Fixes #5492