Skip to content

docs: clarify ownership and times for security reporting #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
May 15, 2025
Merged

docs: clarify ownership and times for security reporting #15

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ae119b3
docs: clarify ownership and times for security reporting
UlisesGascon Mar 3, 2025
c0c9278
Update SECURITY.md
UlisesGascon Mar 4, 2025
4aa140b
Update SECURITY.md
UlisesGascon Mar 4, 2025
96bb4f6
docs: simplified policy
UlisesGascon Mar 8, 2025
f368372
Merge branch 'master' into ulises/response-time
UlisesGascon May 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,20 @@ Thank you for improving the security of Express and related projects.
We appreciate your efforts in responsible disclosure and will make every effort
to acknowledge your contributions.

A [Security triage team member](https://github.com/expressjs/security-wg#security-triage-team)
or [the repo captain](https://github.com/expressjs/express/blob/master/Contributing.md#active-projects-and-captains)
will acknowledge your report as soon as possible.
These timelines may extend when our triage
volunteers are away on holiday, particularly at the end of the year.

After the initial reply to your report, the security team will
endeavor to keep you informed of the progress towards a fix and full
announcement, and may ask for additional information or guidance.

> [!NOTE]
> You can find more information about our process in [this guide](https://github.com/expressjs/security-wg/blob/main/docs/handle_security_reports.md)


### Reporting Security Bugs via GitHub Security Advisory (Preferred)

The preferred way to report security vulnerabilities is through
Expand Down Expand Up @@ -42,7 +56,6 @@ The lead maintainer will acknowledge your email within 48 hours and provide an i

If the security issue pertains to a third-party module that is not directly maintained within the Express ecosystem, please report it to the maintainers of that module.


## Disclosure Policy

When the security team receives a security bug report, they will assign it to a
Expand Down