restify / restify/node-restify
SECURITY.md contact is unreachable — request for private vulnerability disclosure channel
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.7k
- Forks
- 975
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 5
Description
Hi restify maintainers,
I am trying to privately report a security vulnerability affecting restify / node-restify.
I followed the SECURITY.md instructions and attempted to contact security@restify.com, but the message was not delivered. The remote mail server returned:
554 5.7.1 Relay access denied
I also contacted prior maintainers and was advised to reach out to the current maintainers.
I do not want to disclose any technical vulnerability details publicly.
Could you please confirm the correct private security reporting channel, or enable GitHub Private Vulnerability Reporting for this repository?
cc @DonutEspresso @wesleytodd
Thanks,
Nir Yehoshua
Cipher Security Labs
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading SECURITY.md and checking the repository's private vulnerability reporting setting. Verify whether security@restify.com is reachable or whether GitHub's private reporting channel is enabled. Done means the documented private disclosure route works and is clearly stated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- documentation, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100