Responsible Vulnerability Disclosure

cactus / go-camo

A secure image proxy server

MIT License

254 stars 48 forks source link

Responsible Vulnerability Disclosure #35

Closed dappelt closed 5 years ago

dappelt commented 5 years ago

Specifications

Version: go-camo 1.1.4 Platform: Any

Behavior

I would like to report a security vulnerability in go-camo. Is there a prefered (and confidentially) way of receiving more details?

dropwhile commented 5 years ago

@dappelt Thanks for reaching out!

I have a wire account (@ixephus), if that meets your requirements for secure/confidential information exchange. If not, let me know if you have any suggestions for alternatives.

Note: Alas, I seldom use the wire account (not many people I chat with regularly on there yet), so dropping a message like this is probably the best way to get me to check it.

jacobbednarz commented 5 years ago

Side note: @cactus do you intend to use GitHub's maintainer security advisories for this type of thing? As you can also establish a policy in there too which would help this type of discussion.

dropwhile commented 5 years ago

@jacobbednarz Interesting. I didn't realize that advisories allowed for private collaboration. I'll definitely look into it!

dropwhile commented 5 years ago

@jacobbednarz thanks again for the heads up.

Status:

created security policy page - https://github.com/cactus/go-camo/security/policy
created a draft security advisory, and invited @dappelt to collaborate on it.

jacobbednarz commented 5 years ago

nice one! I've just confirmed I can't see it so you're secrets are safe for now 🙂

dappelt commented 5 years ago

created a draft security advisory, and invited @dappelt to collaborate on it.

Perfect, I provided more information on the draft.

dropwhile commented 5 years ago

Yeah, these look like valid issues. Working on fixes.

dropwhile commented 5 years ago

Security advisory has been published.

dropwhile commented 5 years ago

Release v1.1.5 builds are up now.