search

apache / security-vulnogram

Vulnogram is a tool for creating and editing CVE information in CVE JSON format
https://vulnogram.github.io/
MIT License
5 stars 4 forks source link

Send reporter notification along with other emails #28

Open raboof opened 1 year ago

raboof commented 1 year ago

It's easy to forget pinging the reporter when an issue has been made public. It might be neat to introduce a field for reporter email address(es) so they can be bcc'ed with the generated announcement email?

raboof commented 1 year ago

They can now be added to the 'Announcement emails go to this list' list, but that adds them to 'To'/'Reply-To', they may prefer to be Bcc'ed ;)

iamamoose commented 1 year ago

Our process does require a mail at announce time to original reporter. We could parse any 'reporter' fields for email addresses and bcc (but many reporters don't want their email address listed) so it'd have to be a private field.

Or we could assume reporters are on our announce list and just change the default policy.