10000 Incident Response Plan by UlisesGascon · Pull Request #6028 · lodash/lodash · GitHub
[go: up one dir, main page]
Skip to content

Incident Response Plan #6028

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jdalton merged 1 commit into from
Oct 27, 2025
Merged

Incident Response Plan #6028

jdalton merged 1 commit into from
Oct 27, 2025

Conversation

@UlisesGascon
Copy link
Member
@UlisesGascon UlisesGascon commented Oct 21, 2025 •
edited
Loading

Main Changes

This PR includes an Incident Response Plan (IRP) that is heavily inspired by Express.

This is an early version intended to serve as a runbook to guide us during the security triage process.

This PR is very open to feedback and suggestions.

Assumptions

  • A security triage team is in place, so this PR might need to wait until that process is finalized. This is currently being discussed in Backlog: Adopt Security Best Practices #6027.
  • The private repository lodash/security-triage exists and can be used to handle discussions confidentially, since reporters in security advisories have access to all conversation threads — which is not always ideal.
  • The security triage team also uses the private channel #lodash-security-triage for internal communications.
  • As Lodash does not have official social media accounts or a blog, we can request the foundation’s assistance to promote important security communications when necessary. Otherwise, we can limit announcements to release notes or create an issue to notify the community of an upcoming impactful security release (without sharing sensitive details to prevent early disclosure).

Context

@UlisesGascon UlisesGascon changed the title docs: add an IRP Incident Response Plan Oct 21, 2025
@UlisesGascon UlisesGascon mentioned this pull request Oct 21, 2025
Open
9 tasks
@UlisesGascon UlisesGascon marked this pull request as ready for review October 21, 2025 22:54
@jdalton
Copy link
Member
jdalton commented Oct 27, 2025

Thank you @UlisesGascon!

@jdalton jdalton merged commit 23903d3 into lodash:main Oct 27, 2025
@UlisesGascon UlisesGascon added the STA-2025 Issues and tasks related to the work funded by STA for Q4 2025. label Nov 7, 2025
@UlisesGascon UlisesGascon self-assigned this Nov 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jdalton jdalton jdalton approved these changes

Assignees

@UlisesGascon UlisesGascon

Labels

STA-2025 Issues and tasks related to the work funded by STA for Q4 2025.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@UlisesGascon @jdalton
0