How to get in touch regarding a security concern?

Question

How to get in touch regarding a security concern?

cokeBeer opened this issue 2 years ago · comments

Hello 👋

I found a potential security issue in PanIndex, how can I get in touch with you in a private way and submit my security report?

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

libsgh · Answer 1 · Sun Mar 12 2023 07:41:38 GMT+0800 (China Standard Time)

Hello, you can send a message to my private email.

libsgh · Answer 2 · Mon Mar 13 2023 14:30:39 GMT+0800 (China Standard Time)

It has been fixed in version v3.1.3, many thanks

cokeBeer · Answer 3 · Mon Mar 13 2023 14:33:17 GMT+0800 (China Standard Time)

@cokeBeer Hi, what about publishing a github security advisory? If you feel confused about some blanks, you can add me as a collaborator on that page.

libsgh · Answer 4 · Mon Mar 13 2023 15:05:13 GMT+0800 (China Standard Time)

@cokeBeer Hi, what about publishing a github security advisory? If you feel confused about some blanks, you can add me as a collaborator on that page.

That's a great idea, I've added you as a collaborator.

cokeBeer · Answer 5 · Mon Mar 13 2023 15:22:02 GMT+0800 (China Standard Time)

@libsgh Could you request a CVE id in that page before publishing the advisory? Only maintainer can do so.