Add "no public GH Issues please" request, past advisories link, bounty mention, scope link to security.md #40966
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Add links to various relevant pages (scope, existing security advisories) * Add request to not report vulnerabilities in public GH issues * Mention bounty program * Reorganized and added some new headings Signed-off-by: Josh Richards <josh.t.richards@gmail.com>
nickvergessen
changed the title
Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com> Signed-off-by: Josh Richards <josh.t.richards@gmail.com>
nickvergessen
approved these changes
Oct 20, 2023
szaimen
approved these changes
Oct 20, 2023
There was a problem hiding this comment.
Makes sense and LGTM. Should we apply the same changes to https://github.com/nextcloud/.github/blob/master/SECURITY.md?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
I was tempted to add the "No BS" stuff from the HackerOne page, but ultimately opted to keep this the more formal of the two since that is how it's been historically.
TODO
Checklist