Commit 6ae9bc8
doc: add extra step for reporter pre-approval
As discussed in the #security-triagge (OpenJS channel).
To avoid insufficient CVE fixes across Security Release,
might make sense to request a reporter pre-approval.
PR-URL: #44806
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>1 parent 8daceda commit 6ae9bc8
1 file changed
Lines changed: 6 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -44,6 +44,8 @@ The current security stewards are documented in the main Node.js | |||
| 44 | 44 | the date in the slug so that it will move to the top of the blog list.) | |
| 45 | 45 | * (Consider using a [Vulnerability Score System](https://www.first.org/cvss/calculator/3.1) | |
| 46 | 46 | to identify severity of each report) | |
| 47 | + * Share the patch with the reporter when applicable. | ||
| 48 | + It will increase the fix accuracy. | ||
| 47 | 49 | * [ ] pre-release: _**LINK TO PR**_ | |
| 48 | 50 | * [ ] post-release: _**LINK TO PR**_ | |
| 49 | 51 | * List vulnerabilities in order of descending severity | |
@@ -66,6 +68,10 @@ The current security stewards are documented in the main Node.js | |||
| 66 | 68 | * [ ] Check that all vulnerabilities are ready for release integration: | |
| 67 | 69 | * PRs against all affected release lines or cherry-pick clean | |
| 68 | 70 | * Approved | |
| 71 | + * (optional) Approved by the reporter | ||
| 72 | + * Build and send the binary to the reporter according to its architecture | ||
| 73 | + and ask for a review. This step is important to avoid insufficient fixes | ||
| 74 | + between Security Releases. | ||
| 69 | 75 | * Pass `make test` | |
| 70 | 76 | * Have CVEs | |
| 71 | 77 | * Make sure that dependent libraries have CVEs for their issues. We should | |
0 commit comments