Add a security policy - #135
Open
MichaelLeeHobbs wants to merge 1 commit into
Open
Conversation
Point vulnerability reports at GitHub's private reporting rather than the public issue tracker, and state that the hosted DICOM Standard Browser is in scope alongside this repository. The File Editor already directs its bug reports here, so the distinction was not obvious to reporters. Adding this file also makes GitHub surface a "Report a vulnerability" link in the issue chooser at /issues/new/choose.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows #133. There was no documented channel for security reports; private vulnerability reporting is now enabled, so this writes it down.
The substantive part is the scope section. This repository publishes the data, but the File Editor at dicom.innolitics.com sends its bug reports here, so it isn't obvious to a reporter whether the hosted browser is in scope or where a given problem belongs. The file says so explicitly, and marks faithfully-parsed-but-wrong values as ordinary issues rather than security ones.
Adding
SECURITY.mdalso makes GitHub surface a "Report a vulnerability" link in the issue chooser at/issues/new/choose, which is exactly where the File Editor's "open an issue" link already points.It also asks reporters not to test against the live site, and notes that the published bundles ship source maps so the browser can be checked offline instead.
One file, no code changes. Happy to reword any of it, particularly the scope section if I've drawn the boundary in the wrong place.