search

418sec / huntr

Public Roadmap | huntr.dev
https://huntr.dev
265 stars 90 forks source link

Differentiate between fixing a report and making it public. #2198

Closed ysf closed 1 year ago

ysf commented 2 years ago

In the current version of huntr.dev a report goes public when a maintainer assigned a fix to an issue. I think it'll be better to differentiate between fixing a flaw and publishing it.

  1. It'll be similar to the original CVE process and general public disclosure policy
  2. Coordination in a bug accross multiple projects is easier to handle
  3. Maintainers can assign a fix asap and don't have to hold it back until they made a new release.
jaapmarcus commented 2 years ago

See also #2143

But agree waited 2 weeks ago an "low" impact bug report that was fixed but we had to delay the release ...

tommoor commented 2 years ago

Big agreement, I'm waiting on marking reports as fixed that have been to avoid them going public immediately now. But in return that's going to ding my maintainer stats.

psmoros commented 1 year ago

Hi everyone! We now have a separate publish state for reports :)