New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

How to handle security reports #359

Open

pllim opened this issue Sep 11, 2023 · 1 comment

Labels

Member

pllim commented Sep 11, 2023

There is a need to:

Have a formal chain of communication when a report comes in. Not everyone watch GitHub, etc. Who needs to know.
Update https://github.com/astropy/astropy/blob/main/SECURITY.md with any addition to the policy. Would be nice to tell people that they can open PR but be discrete about it or whatever.

p.s. I wonder if we can emulate some from https://www.python.org/dev/security/

pllim added the policy 📄 label

Contributor

dhomeier commented Sep 12, 2023

p.s. I wonder if we can emulate some from https://www.python.org/dev/security/

May be the way to go; apparently Jupyter has set up something similar.

pllim mentioned this issue

Add a role for security team astropy/astropy.github.com#551

Merged

pllim mentioned this issue

DOC: Updated text w.r.t. security reporting astropy/astropy#15556

Merged

2 tasks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment