Community: Set security policies
We should have a private [email protected] alias, GPG key, and set up SECURITY.md for all our repos.
lizthegrey
All 8 comments
Do you have some links on best practices on how it will be used?
SergeyKanzhelev
on 1 Jul 2020
Not claiming it's a best practice, but just as a reference to what we did in Jaeger. Website footer contains a link to report security issues
which takes you to https://www.jaegertracing.io/report-security-issue/
yurishkuro
on 2 Jul 2020
That's correct, the goal is to enable people with critical security issues to responsibly disclose to us without going through public issue trackers, in order to allow us to remediate, push releases, and issue security advisories.
lizthegrey
on 2 Jul 2020
I'll bring this up at Governance this week, but it's probably more properly a matter for the TC.
lizthegrey
on 9 Jul 2020
Added to TC meeting agenda
SergeyKanzhelev
on 17 Sep 2020
Related PR by @jpkrohling: https://github.com/open-telemetry/opentelemetry-specification/pull/990
arminru
on 23 Sep 2020
I would also recommend each repo to add an issue template "Report a security vulnerability".
Cf: https://github.com/jaegertracing/jaeger/issues/new/choose
yurishkuro
on 23 Sep 2020
That one is actually a link to the policy, which is created automatically when you add a SECURITY.md to the repo.
jpkrohling
on 23 Sep 2020
Related issues
WPH95
路
3Comments
ahayworth
路
3Comments
breedx-splk
路
3Comments
lalitb
路
3Comments
dashpole
路
3Comments
Most helpful comment
Not claiming it's a best practice, but just as a reference to what we did in Jaeger. Website footer contains a link to report security issues
which takes you to https://www.jaegertracing.io/report-security-issue/