-
-
Notifications
You must be signed in to change notification settings - Fork 7
Process to handle security reports #56
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
In general, i'm okay |
wesleytodd
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks great! I know you said "early", so I look forward to seeing what else we add. I know for myself it would be awesome to have some more of these steps have more details and links, similar to a runbook format.
Aside: the mermaid rendering is awesome. I need to use this more often.
100% if this mermaid flow seems "good" I will start working on the runbook part (I just wanted to avoid many logic/text changes combined). Sounds good if we include the runbook in this document and PR? Or do we prefer to do it in a separate one to simplify the review process? |
|
Ok, so based on the positive early feedback on the process I included the runbook too 🥳 |
Co-authored-by: Sebastian Beltran <[email protected]>
Co-authored-by: Sebastian Beltran <[email protected]>
Co-authored-by: Sebastian Beltran <[email protected]>
|
I solved the format issues in 054ab8a |
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
Co-authored-by: Chris de Almeida <[email protected]>
|
I think that I addressed most of the comment, but let me know if I missed something or closed a discussion prematurely. |
|
I am merging this now, as I plan to do an additional PR to include the new process on the Bug Bounty Program (#64 (comment)). There we can include additional changes if needed. |
I am working on this process for the @expressjs/security-triage team.
I would love to get your feedback (@expressjs/express-tc @expressjs/security-wg @expressjs/security-triage ) on the current state before I begin defining this process in detail, as the changes will become more complex. Could you please share your first impressions of this process?
Note: This flow also covers unusual scenarios, such as when someone submits a security report as an issue or directly in a PR as a patch. I wanted to align this process with what Node.js has in place today. Reference