Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to get in touch regarding a security concern #2935

Closed
JamieSlome opened this issue Dec 8, 2021 · 7 comments · Fixed by #2939
Closed

How to get in touch regarding a security concern #2935

JamieSlome opened this issue Dec 8, 2021 · 7 comments · Fixed by #2939
Milestone

Comments

@JamieSlome
Copy link

Hey there!

I belong to an open source security research community, and a member (@dwisiswant0) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

@asbjornu
Copy link
Member

asbjornu commented Dec 9, 2021

@JamieSlome, thanks for the nudge to create a security policy. It is now in place and you can e-mail [email protected] with your inquiry.

@JamieSlome
Copy link
Author

@asbjornu - awesome, you should receive an e-mail shortly!

Otherwise, you can view the private report directly here:

https://huntr.dev/bounties/11348026-ad4d-4dc7-ab7b-2273f9b2a40d/

It is only visible to maintainers with write access to the repository (BTW).

@asbjornu
Copy link
Member

asbjornu commented Dec 10, 2021 via email

@JamieSlome
Copy link
Author

@dwisiswant0 - can you please address the above?

@asbjornu
Copy link
Member

I've replied in https://huntr.dev/bounties/11348026-ad4d-4dc7-ab7b-2273f9b2a40d/ as well, so please follow up there.

@arturcic arturcic added this to the 5.x milestone Feb 16, 2022
@arturcic arturcic modified the milestones: 5.x, 5.8.2 Feb 16, 2022
@github-actions
Copy link

🎉 This issue has been resolved in version 5.8.2 🎉
The release is available on:

Your GitReleaseManager bot 📦🚀

@JamieSlome
Copy link
Author

@dwisiswant0 - please see the above + the maintainers comments on the report 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants