Commit ecc8551
doc: improve security text in collaborators guide
PR-URL: #38107
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>1 parent 6c970ba commit ecc8551
1 file changed
Lines changed: 14 additions & 21 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -90,32 +90,25 @@ to land but is [author ready](#author-ready-pull-requests), add the | |||
| 90 | 90 | ||
| 91 | 91 | ### Managing security issues | |
| 92 | 92 | ||
| 93 | - Security issues should ideally be reported through the processes outlined in | ||
| 94 | - [SECURITY.md][security reporting]. This allows the collaborators to | ||
| 95 | - appropriately triage the report and address vulnerabilities in a planned | ||
| 96 | - security release. If an issue is opened in the public repo | ||
| 97 | - which describes a security issue, or if an issue is later identified to be | ||
| 98 | - describing a security issue, take the following steps: | ||
| 99 | - | ||
| 100 | - * Ask the originator to submit a report through Hacker one as outlined in | ||
| 101 | - [SECURITY.md][security reporting]. | ||
| 93 | + Use the process outlined in [SECURITY.md][] to report security | ||
| 94 | + issues. If a user opens a security issue in the public repository: | ||
| 95 | + | ||
| 96 | + * Ask the user to submit a report through HackerOne as outlined in | ||
| 97 | + [SECURITY.md][]. | ||
| 102 | 98 | * Move the issue to the private repo called | |
| 103 | 99 | [premature-disclosures](https://github.com/nodejs/premature-disclosures). | |
| 104 | 100 | * For any related pull requests, create an associated issue in the | |
| 105 | 101 | `premature-disclosures` repository. Add a copy of the patch for the | |
| 106 | 102 | pull request to the issue. Add screenshots of discussion from the pull request | |
| 107 | 103 | to the issue. | |
| 108 | - * Open a ticket with GitHub asking that the pull requests be deleted through | ||
| 109 | - [GitHub support](https://support.github.com/contact) | ||
| 110 | - using Node.js(team) as the account organization. | ||
| 111 | - * Open a new issue in the repository in which the issue was originally | ||
| 112 | - reported with a brief FYI to the originator: "FYI @xxxx we asked GitHub | ||
| 113 | - to delete your pull request while we work on releases in private." with the | ||
| 114 | - title `FYI - pull request deleted #YYYY`. | ||
| 115 | - * Email `tsc@iojs.org` with the link to the issues in the | ||
| 116 | - `premature-disclosures` repo so that the TSC is aware that they | ||
| 117 | - may need to expedite handling of the issue due to premature | ||
| 118 | - disclosure. | ||
| 104 | + * [Open a ticket with GitHub](https://support.github.com/contact) to delete the | ||
| 105 | + pull request using Node.js (team) as the account organization. | ||
| 106 | + * Open a new issue in the public repository with the title `FYI - pull request | ||
| 107 | + deleted #YYYY`. Include an explanation for the user: | ||
| 108 | + > FYI @xxxx we asked GitHub to delete your pull request while we work on | ||
| 109 | + > releases in private. | ||
| 110 | + * Email `tsc@iojs.org` with links to the issues in the | ||
| 111 | + `premature-disclosures` repository. | ||
| 119 | 112 | ||
| 120 | 113 | ## Accepting modifications | |
| 121 | 114 | ||
@@ -842,6 +835,7 @@ If you cannot find who to cc for a file, `git shortlog -n -s <file>` can help. | |||
| 842 | 835 | ||
| 843 | 836 | ["Merge Pull Request"]: https://help.github.com/articles/merging-a-pull-request/#merging-a-pull-request-on-github | |
| 844 | 837 | [Deprecation]: https://en.wikipedia.org/wiki/Deprecation | |
| 838 | + [SECURITY.md]: https://github.com/nodejs/node/blob/HEAD/SECURITY.md | ||
| 845 | 839 | [Stability Index]: ../api/documentation.md#stability-index | |
| 846 | 840 | [TSC]: https://github.com/nodejs/TSC | |
| 847 | 841 | [`--pending-deprecation`]: ../api/cli.md#--pending-deprecation | |
@@ -856,5 +850,4 @@ If you cannot find who to cc for a file, `git shortlog -n -s <file>` can help. | |||
| 856 | 850 | [git-username]: https://help.github.com/articles/setting-your-username-in-git/ | |
| 857 | 851 | [node-core-utils-credentials]: https://github.com/nodejs/node-core-utils#setting-up-credentials | |
| 858 | 852 | [node-core-utils-issues]: https://github.com/nodejs/node-core-utils/issues | |
| 859 | - [security reporting]: https://github.com/nodejs/node/blob/HEAD/SECURITY.md | ||
| 860 | 853 | [unreliable tests]: https://github.com/nodejs/node/issues?q=is%3Aopen+is%3Aissue+label%3A%22CI+%2F+flaky+test%22 | |
0 commit comments