webpack / webpack/working-groups
[SEG-WG] Set up process for premature disclosure
Open
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
As with every software, eventually, someone may report a security issue as a public issue. In the event of a premature disclosure, we should have a contingency plan set up.
At @nodejs, this goes something along the lines of:
- Transfer the issue to a private repository
- Prepare and discuss a patch in the private repository
- Issue a security release via a push directly to the public repository
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the three-step @nodejs precedent described in the issue: private transfer, patch preparation, and a security release. Define and document the project's contingency process for premature public disclosures, including what completion means for each step and who handles it.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100