🐛 🛡️ | Security vulnerability disclosure

[kazet]

Hello,

CERT PL found a security vulnerability in this repository. How can we report this privately? We don't see any security policy describing how such vulnerabilities should be reported.

[Groovylein]

Hi, How did CERT PL got attention to this repository?

Do you have a recommendation or example how this can be handled or is handled in other repositories?

[lukigruszka]

Hi, CERT PL has performed a broad vulnerability scan of open source projects and that one was tested as well.

Different ways of handling such reports are possible, it depends on the level of confidentiality one wants to achieve. Solutions start from specifying a dedicated e-mail address and a corresponding PGP public key, through web forms with TLS encryption, ending with publicly discussing them as regular issues on GitHub

[s-martin]

Duplicate of #2342