You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I wanted to know if there is a way to submit security issues. There is no Security.md file in the repo. This is a requirement for me to be able to use the product. Are there plans to add a security policy?
There are no plans to add a security policy as there has been no pressing need. But it is possible to contact repo owner (me) directly by email, just look it up.
I don't feel like setting up a dedicated email for this, but you have any suggestions be my guest.
There have historically been a few issues that could have warranted a CVE alert but they have been fixed timely and https://github.com/dvidelabs/flatcc/blob/master/CHANGELOG.md is the best place to stay on top of issues.
Thanks for following up. These are reasonable suggestions.I think I might consider adding a SECURITY.md file, but then again, security is already referenced in the README, so I think that unless I set up a specific email address, it would not add much. For now I'm happy that my email is discoverable without being blatantly obvious.
As to supported versions, there aren't really any unsupported versions, but due to CI builds, the latest should work on a very large range of systems while being backwards compatible, so there isn't really much motivation for sticking with an older version, unless for code review reasons. If there is a specific concern in that regard, I'd advise looking through the change list and consider patching important fixes. If that is insufficient, open an issue, I'll see what can be done. If that is insufficient, consulting could be an option.
Feel free to use this issue as reference for internal documentation.
Activity
mikkelfj commentedon Sep 28, 2024
This is not exactly what you are asking for, but there is: https://github.com/dvidelabs/flatcc/blob/master/doc/security.md
There are no plans to add a security policy as there has been no pressing need. But it is possible to contact repo owner (me) directly by email, just look it up.
I don't feel like setting up a dedicated email for this, but you have any suggestions be my guest.
There have historically been a few issues that could have warranted a CVE alert but they have been fixed timely and https://github.com/dvidelabs/flatcc/blob/master/CHANGELOG.md is the best place to stay on top of issues.
abnara commentedon Sep 28, 2024
Thanks for the quick reply :)
Maybe a Security.md can be committed with these 3 sections:
I know all this information already exists in different parts of the repo., but would help create some sort of “official” security policy.
abnara commentedon Oct 10, 2024
Hi @mikkelfj
Any thoughts on my suggestion?
mikkelfj commentedon Oct 14, 2024
Thanks for following up. These are reasonable suggestions.I think I might consider adding a SECURITY.md file, but then again, security is already referenced in the README, so I think that unless I set up a specific email address, it would not add much. For now I'm happy that my email is discoverable without being blatantly obvious.
As to supported versions, there aren't really any unsupported versions, but due to CI builds, the latest should work on a very large range of systems while being backwards compatible, so there isn't really much motivation for sticking with an older version, unless for code review reasons. If there is a specific concern in that regard, I'd advise looking through the change list and consider patching important fixes. If that is insufficient, open an issue, I'll see what can be done. If that is insufficient, consulting could be an option.
Feel free to use this issue as reference for internal documentation.
I will convert this it a discussion.