search

kohler / hotcrp

HotCRP conference review software
http://read.seas.harvard.edu/~kohler/hotcrp
Other
330 stars 112 forks source link

Question Regarding Vulnerability Disclosure #369

Open leeN opened 3 days ago

leeN commented 3 days ago

Hi all,

I emailed Eddie about a vulnerability in hotcrp but have yet to hear back. So, I'd like to ask about the best way to disclose security issues.

Reporting via Email feels very unreliable, as some mail servers filter attachments with source code and others filter encrypted archives to avoid the abovementioned filters. Similarly, posting it here is obviously wrong, as it affects most major security conferences using hotcrp.com.

Cheers, David

kohler commented 3 days ago

My email is the best place, ekohler@gmail.com. However, I have not seen your email about a hotcrp vulnerability. A search does not turn anything up.

kohler commented 17 hours ago

Have you sent me anything? @leeN