Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add security contact information #10

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add security contact information #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0031376
Create security.md
gregmarsden Oct 30, 2023
035ccf3
Add encryption key note for TSC contact info
gregmarsden Oct 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion TSC/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,4 +67,6 @@ requested and approved by the OpenELA TSC on a per-individual basis.

## Contacting the OpenELA TSC

The TSC can be contacted via the email address: [[email protected]](mailto:[email protected])
The TSC can be contacted via the email address: [[email protected]](mailto:[email protected])
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: missing dot at the end of the line

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'll respin this PR without modifying that line

GPG public key available upon request.

7 changes: 7 additions & 0 deletions security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Reporting OpenELA Security Vulnerabilities

## Reporting Security Issues
Please report security issues to the Technical Steering Committee.
https://github.com/openela/governance/tree/main/TSC#contacting-the-openela-tsc

We encourage the use of GPG encrypted email.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fine. I wonder if we could simply use the GitHub builtin vulnerability reporting instead? Would allow collaboration on issues.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would probably work assuming the TSC gets notified. The one complication is that we'd be directing folks to use a specific repository (the issues repository, which doesn't exist yet) rather than allowing issues everywhere in openela-main, and that would prevent the private-issues-reporting tool from creating forks (since it'd be a different repository).