doc: clarify reports are only evaluated on active versions · nodejs/node@f8511e0 · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 632
• Pull requests 755
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit f8511e0

Browse filesBrowse the repository at this point in the historyBrowse files

RafaelGSS

committed

doc: clarify reports are only evaluated on active versions

PR-URL: #47341 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

1 parent bbde68e commit f8511e0
Copy full SHA for f8511e0

1 file changed

+6-5Lines changed: 6 additions & 5 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• SECURITY.md

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎SECURITY.md‎

Copy file name to clipboardExpand all lines: SECURITY.md

+6-5Lines changed: 6 additions & 5 deletions

• Display the source diff
• Display the rich diff

Original file line number	Diff line number	Diff line change
@@ -31,11 +31,12 @@ maintainers.
31	31	Here is the security disclosure policy for Node.js
32	32
33	33	* The security report is received and is assigned a primary handler. This
34		- person will coordinate the fix and release process. The problem is confirmed
35		- and a list of all affected versions is determined. Code is audited to find
36		- any potential similar problems. Fixes are prepared for all releases which are
37		- still under maintenance. These fixes are not committed to the public
38		- repository but rather held locally pending the announcement.
	34	+ person will coordinate the fix and release process. The problem is validated
	35	+ against all supported Node.js versions. Once confirmed, a list of all affected
	36	+ versions is determined. Code is audited to find any potential similar
	37	+ problems. Fixes are prepared for all supported releases.
	38	+ These fixes are not committed to the public repository but rather held locally
	39	+ pending the announcement.
39	40
40	41	* A suggested embargo date for this vulnerability is chosen and a CVE (Common
41	42	Vulnerabilities and Exposures (CVE®)) is requested for the vulnerability.

0 commit comments

Comments

0 (0)