search

benfred / py-spy

Sampling profiler for Python programs
MIT License
12.53k stars 414 forks source link

Create SECURITY.md #507

Closed JamieSlome closed 2 years ago

JamieSlome commented 2 years ago

Hello 👋

I run a security community that finds and fixes vulnerabilities in OSS. A researcher (@jhond0e) has found a potential issue, which I would be eager to share with you.

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

Looking forward to hearing from you 👍

(cc @huntr-helper)

benfred commented 2 years ago

Thanks for the heads up!

I'll definitely create a SECURITY.md file - but in the meantime you can email me at ben@benfrederickson.com

benfred commented 2 years ago

I've added a very basic SECURITY.md in https://github.com/benfred/py-spy/commit/4fea09d312924928475c4cd509b21aaed09dda60 - let me know if you think any more information belongs in there

JamieSlome commented 2 years ago

@benfred - thanks for your diligence!

I will get more details sent over to your e-mail address shortly 👍

Just for reference, the report can also be found directly here: https://huntr.dev/bounties/1af8d818-8b3c-4c8e-a75e-158cdd3423ec/

It is private and only accessible to you :)