Commit 280d1b0
doc: add process for handling premature disclosure
Add process for handling premature disclosure of
a security vulnerability in the public repos.
Signed-off-by: Michael Dawson <mdawson@devrus.com>
PR-URL: #36155
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Mary Marchini <oss@mmarchini.me>
Reviewed-By: Rich Trott <rtrott@gmail.com>1 parent ad39b37 commit 280d1b0
1 file changed
Lines changed: 30 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -7,6 +7,7 @@ | |||
| 7 | 7 | * [Closing issues and pull requests](#closing-issues-and-pull-requests) | |
| 8 | 8 | * [Author ready pull requests](#author-ready-pull-requests) | |
| 9 | 9 | * [Handling own pull requests](#handling-own-pull-requests) | |
| 10 | + * [Security issues](#managing-security-issues) | ||
| 10 | 11 | * [Accepting modifications](#accepting-modifications) | |
| 11 | 12 | * [Code reviews](#code-reviews) | |
| 12 | 13 | * [Consensus seeking](#consensus-seeking) | |
@@ -87,6 +88,34 @@ to land but is [author ready](#author-ready-pull-requests), add the | |||
| 87 | 88 | `author ready` label. If you wish to land the pull request yourself, use the | |
| 88 | 89 | "assign yourself" link to self-assign it. | |
| 89 | 90 | ||
| 91 | + ### Managing security issues | ||
| 92 | + | ||
| 93 | + Security issues should ideally be reported through the processes outlined in | ||
| 94 | + [SECURITY.md][security reporting]. This allows the collaborators to | ||
| 95 | + appropriately triage the report and address vulnerabilities in a planned | ||
| 96 | + security release. If an issue is opened in the public repo | ||
| 97 | + which describes a security issue, or if an issue is later identified to be | ||
| 98 | + describing a security issue, take the following steps: | ||
| 99 | + | ||
| 100 | + * Ask the originator to submit a report through Hacker one as outlined in | ||
| 101 | + [SECURITY.md][security reporting]. | ||
| 102 | + * Move the issue to the private repo called | ||
| 103 | + [premature-disclosures](https://github.com/nodejs/premature-disclosures). | ||
| 104 | + * For any related pull requests create an associated issue in the | ||
| 105 | + `premature-disclosures` repo and add a copy of the patch for the | ||
| 106 | + pull request, and screenshots of discussion on the PR to the issue. | ||
| 107 | + * Open a ticket with GitHub asking that the PRs be deleted through | ||
| 108 | + [GitHub suppport](https://support.github.com/contact) | ||
| 109 | + using Node.js(team) as the account organization. | ||
| 110 | + * Open a new issue in the repository in which the issue was originally | ||
| 111 | + reported with a brief FYI to the originator. `FYI @xxxx we asked github | ||
| 112 | + to delete your PR while we work on releases in private.` with the title | ||
| 113 | + `FYI - PR deleted #YYYY`. | ||
| 114 | + * Email `tsc@iojs.org` with the link to the issues in the | ||
| 115 | + `premature-disclosures` repo so that the TSC is aware that they | ||
| 116 | + may need to expedite handling of the issue due to premature | ||
| 117 | + disclosure. | ||
| 118 | + | ||
| 90 | 119 | ## Accepting modifications | |
| 91 | 120 | ||
| 92 | 121 | Contributors propose modifications to Node.js using GitHub pull requests. This | |
@@ -791,4 +820,5 @@ If you cannot find who to cc for a file, `git shortlog -n -s <file>` can help. | |||
| 791 | 820 | [git-username]: https://help.github.com/articles/setting-your-username-in-git/ | |
| 792 | 821 | [node-core-utils-credentials]: https://github.com/nodejs/node-core-utils#setting-up-credentials | |
| 793 | 822 | [node-core-utils-issues]: https://github.com/nodejs/node-core-utils/issues | |
| 823 | + [security reporting]: https://github.com/nodejs/node/blob/HEAD/SECURITY.md | ||
| 794 | 824 | [unreliable tests]: https://github.com/nodejs/node/issues?q=is%3Aopen+is%3Aissue+label%3A%22CI+%2F+flaky+test%22 | |
0 commit comments