Add a security policy file
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.2k
- Forks
- 409
- PR merge metrics
- No merged PRs in 30d
Description
I've noticed that CONTRIBUTING.md points users to Facebook's bug-bounty program in case any security vulnerabilities are found in the project. Is that still the proper venue after PyTorch migrated to the Linux Foundation?
Regardless, having this information on a separate SECURITY.md file makes it much more visible for users. It'll be front and center for users who enter the project's "Security" panel, and they'll also see references to the policy in the "New issue" page.
If there's interest, I'd be happy to submit a PR with a draft policy (based on CONTRIBUTING.md or with any new information).
Disclosure: My name is Pedro and I work with Google and the Open Source Security Foundation (OpenSSF) to improve the supply-chain security of the open-source ecosystem.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing CONTRIBUTING.md#issues and the current security-reporting venue after the Linux Foundation migration. Draft SECURITY.md from the existing guidance or confirmed new information, then verify that it clearly directs users to the appropriate disclosure process and is surfaced by the repository's Security and New issue pages.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100