8000 doc: add process for handling premature disclosure · nodejs/node@280d1b0 · GitHub
[go: up one dir, main page]
Skip to content

Commit 280d1b0

Browse files
mhdawsontargos
mhdawson
authored and
targos
committed
doc: add process for handling premature disclosure
Add process for handling premature disclosure of a security vulnerability in the public repos. Signed-off-by: Michael Dawson <mdawson@devrus.com> PR-URL: #36155 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Mary Marchini <oss@mmarchini.me> Reviewed-By: Rich Trott <rtrott@gmail.com>
1 parent ad39b37 commit 280d1b0

File tree

1 file changed

+30
-0
lines changed

1 file changed

+30
-0
lines changed

‎doc/guides/collaborator-guide.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
* [Closing issues and pull requests](#closing-issues-and-pull-requests)
88
* [Author ready pull requests](#author-ready-pull-requests)
99
* [Handling own pull requests](#handling-own-pull-requests)
10+
* [Security issues](#managing-security-issues)
1011
* [Accepting modifications](#accepting-modifications)
1112
* [Code reviews](#code-reviews)
1213
* [Consensus seeking](#consensus-seeking)
@@ -87,6 +88,34 @@ to land but is [author ready](#author-ready-pull-requests), add the
8788
`author ready` label. If you wish to land the pull request yourself, use the
8889
"assign yourself" link to self-assign it.
8990

91+
### Managing security issues
92+
93+
Security issues should ideally be reported through the processes outlined in
94+
[SECURITY.md][security reporting]. This allows the collaborators to
95+
appropriately triage the report and address vulnerabilities in a planned
96+
security release. If an issue is opened in the public repo
97+
which describes a security issue, or if an issue is later identified to be
98+
describing a security issue, take the following steps:
99+
100+
* Ask the originator to submit a report through Hacker one as outlined in
101+
[SECURITY.md][security reporting].
102+
* Move the issue to the private repo called
103+
[premature-disclosures](https://github.com/nodejs/premature-disclosures).
104+
* For any related pull requests create an associated issue in the
105+
`premature-disclosures` repo and add a copy of the patch for the
106+
pull request, and screenshots of discussion on the PR to the issue.
107+
* Open a ticket with GitHub asking that the PRs be deleted through
108+
[GitHub suppport](https://support.github.com/contact)
109+
using Node.js(team) as the account organization.
110+
* Open a new issue in the repository in which the issue was originally
111+
reported with a brief FYI to the originator. `FYI @xxxx we asked github
112+
to delete your PR while we work on releases in private.` with the title
113+
`FYI - PR deleted #YYYY`.
114+
* Email `tsc@iojs.org` with the link to the issues in the
115+
`premature-disclosures` repo so that the TSC is aware that they
116+
may need to expedite handling of the issue due to premature
117+
disclosure.
118+
90119
## Accepting modifications
91120

92121
Contributors propose modifications to Node.js using GitHub pull requests. This
@@ -791,4 +820,5 @@ If you cannot find who to cc for a file, `git shortlog -n -s <file>` can help.
791820
[git-username]: https://help.github.com/articles/setting-your-username-in-git/
792821
[node-core-utils-credentials]: https://github.com/nodejs/node-core-utils#setting-up-credentials
793822
[node-core-utils-issues]: https://github.com/nodejs/node-core-utils/issues
823+
[security reporting]: https://github.com/nodejs/node/blob/HEAD/SECURITY.md
794824
[unreliable tests]: https://github.com/nodejs/node/issues?q=is%3Aopen+is%3Aissue+label%3A%22CI+%2F+flaky+test%22

0 commit comments

Comments
 (0)
0