There is no SECURITY.md in this repo, and no documented place to send a security report. GitHub private vulnerability reporting is available but unused.
That is a gap for a public repository, and it also means we have no internal convention for deciding whether a given finding should be a public issue or a private advisory. Several issues filed today were judgement calls made without a policy to point at.
Proposed:
- Add
SECURITY.md with a reporting address or enable GitHub private vulnerability reporting (or both).
- State the supported versions and what is currently in scope. Given that the kernel is pre-production, it is reasonable and honest to say so explicitly — it materially changes how a reporter should treat a finding.
- Document the internal convention: what gets filed publicly versus privately, and who triages.
- Name an owner. There is currently nobody designated, which is the actual root problem here.
Related: #777.
There is no
SECURITY.mdin this repo, and no documented place to send a security report. GitHub private vulnerability reporting is available but unused.That is a gap for a public repository, and it also means we have no internal convention for deciding whether a given finding should be a public issue or a private advisory. Several issues filed today were judgement calls made without a policy to point at.
Proposed:
SECURITY.mdwith a reporting address or enable GitHub private vulnerability reporting (or both).Related: #777.