Repository navigation
docs(security): direct vulnerability reports to GitHub private reporting - #5152
Open
sagikazarmark wants to merge 1 commit into
Open
sagikazarmark wants to merge 1 commit into
sagikazarmark wants to merge 1 commit into
Conversation
Replace the email reporting channel with GitHub's private vulnerability reporting, state that email reports are no longer accepted, and ask reporters to include reproduction steps and code. Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
sagikazarmark
added
the
release-note/ignore
nabokihms
approved these changes
Nov 12, 2026
nabokihms
left a comment
nabokihms
left a comment
Member
There was a problem hiding this comment.
Looks good, thanks! Two small things inline.
|
|
||
| The reporter(s) can expect a response within 48 hours acknowledging the issue | ||
| was received. If a response is not received within 48 hours, please reach out | ||
| to any maintainer directly to confirm receipt of the issue. |
Member
There was a problem hiding this comment.
With the email gone, a reporter who hears nothing in 48 hours has no way to reach us here. Could you link MAINTAINERS.md, or say which channel to use (CNCF Slack #dex)?
Comment on lines
+39
to
+41
| the maintainers and the reporter(s). If the reporter(s) does not wish to | ||
| participate directly in the discussion, then the reporter(s) can request to be | ||
| updated regularly through the advisory. |
Member
There was a problem hiding this comment.
Nit: a private report already makes the reporter a collaborator on the draft advisory, so they get its updates anyway. I'd drop this sentence.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Update
.github/SECURITY.mdso vulnerability reports go through GitHub's private vulnerability reporting.What this PR does / why we need it
Special notes for your reviewer
Private vulnerability reporting must be enabled in the repository settings (Settings → Code security) for the link to work.