Commit 7d50fe6
doc: mention DEPENDENCY custom field for H1 reports
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #64634
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent 46b1177 commit 7d50fe6
1 file changed
Lines changed: 2 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -67,6 +67,8 @@ The current security stewards are documented in the main Node.js | |||
| 67 | 67 | * [ ] 3\. **Assigning Severity and Writing Team Summary:** | |
| 68 | 68 | * [ ] Assign a severity and write a team summary on HackerOne for the reports | |
| 69 | 69 | chosen in the `vulnerabilities.json`. | |
| 70 | + * [ ] If a report targets a Node.js dependency, such as `undici` or `llhttp`, | ||
| 71 | + make sure to update the `DEPENDENCY` custom field on HackerOne. | ||
| 70 | 72 | * Run `git node security --sync` to update severity and summary in | |
| 71 | 73 | `vulnerabilities.json`. | |
| 72 | 74 | ||
0 commit comments