Commit 3ff00e1
doc: add procedure when CVEs don't get published
This was the workaround provided by HackerOne team
PR-URL: #50945
Refs: nodejs/security-wg#1058
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>1 parent 8a08275 commit 3ff00e1
1 file changed
Lines changed: 6 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -200,6 +200,12 @@ out a better way, forward the email you receive to | |||
| 200 | 200 | * Request publication of [H1 CVE requests][] | |
| 201 | 201 | * (Check that the "Version Fixed" field in the CVE is correct, and provide | |
| 202 | 202 | links to the release blogs in the "Public Reference" section) | |
| 203 | + * In case the reporter doesn't accept the disclosure follow this process: | ||
| 204 | + * Remove the original report reference within the reference text box and | ||
| 205 | + insert the public URL you would like to be attached to this CVE. | ||
| 206 | + * Then uncheck the Public Disclosure on HackerOne box at the bottom of the | ||
| 207 | + page. | ||
| 208 | +  | ||
| 203 | 209 | ||
| 204 | 210 | * [ ] PR machine-readable JSON descriptions of the vulnerabilities to the | |
| 205 | 211 | [core](https://github.com/nodejs/security-wg/tree/HEAD/vuln/core) | |
0 commit comments