search

jbeder / yaml-cpp

A YAML parser and emitter in C++
MIT License
4.92k stars 1.78k forks source link

Add a Security-Policy #1188

Closed diogoteles08 closed 10 months ago

diogoteles08 commented 1 year ago

Hi @jbeder! I'm Diogo and I'm back (see #1174) hoping to offer a bit more help with security enhancements.

This time I'm here to suggest that you expose a way that users can report eventual vulnerabilities in a safe and efficient way. This is usually described in a Security Policy, which is a GitHub standard document (SECURITY.md) added on the root of the repo and will be visible to the users in the "Security Tab".

image

It is a recommendation from Github itself, and from Scorecard (being a security measure of medium priority).

Aiming to make this change easier, I'll take the liberty of submitting one suggestion of a Security Policy as a PR. Please feel free to edit it directly or ask me for editions until it is in compliance with how jbeder/yaml-cpp would best handle vulnerability reports.

diogoteles08 commented 10 months ago

Hey @jbeder! This issue has been idle for quite some time. Do you plan on considering these changes? Otherwise I will wait up to 2 more months and close the issue.

Thanks!

jbeder commented 10 months ago

Merged, sorry for the delay!