Update security process #1564
Merged
Update security process #1564
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
clanmills
approved these changes
Apr 17, 2021
There was a problem hiding this comment.
This is really good. Thank You very much for working on this.
I'm so happy that you have volunteered. I would have liked to have done more in this area (and localisation). I hope more contributors will make Exiv2 better and stronger.
I'm delighted by the emerging cooperation with Yaun. I am concerned that his enthusiasm for security drowns our development efforts and undermines Exiv2 credibility and good reputation.
clanmills
previously approved these changes
Apr 17, 2021
kevinbackhouse
force-pushed
the
SecurityContact
branch
from
d7e92e0
to
ad5bac9
Compare
|
I added an extra paragraph to clarify that bugs found on the main branch aren't security bugs, unless they are also reproducible on an official release, such as v0.27.3. |
hassec
approved these changes
May 7, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Suggested update to our security process.
Note: I removed the "Reported CVEs" section because it is incomplete and will become obsolete with this new process.