removed the text and added a more Template version#7
removed the text and added a more Template version#7AnirudhKarthikofficial wants to merge 1 commit intot33devv:mainfrom
Conversation
Updated the reporting section for vulnerabilities.
There was a problem hiding this comment.
Pull request overview
This pull request updates the "Reporting a Vulnerability" section in the SECURITY.md file by replacing the previous placeholder text with a new template that includes contact information placeholders.
Changes:
- Removed the previous instructional placeholder text that explained what information should be included in the vulnerability reporting section
- Added a new single-line template with placeholder text for contact information
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| declined, etc. | ||
|
|
||
| *this section can be edited only by the original creator since i dont have access to this info* | ||
| Contact Info: (DEMO EMAIL aka TOBIAS EMAIL, OR EXTENSION Email) |
There was a problem hiding this comment.
The "Reporting a Vulnerability" section now lacks important information that was present before. While the previous text was a placeholder, it indicated that this section should include details about where to report vulnerabilities, how often reporters can expect updates, and what to expect during the process. The new version only provides a placeholder for contact information but removes guidance about the vulnerability reporting process. Consider including clear instructions on how to report vulnerabilities, expected response times, and the triage process.
| Contact Info: (DEMO EMAIL aka TOBIAS EMAIL, OR EXTENSION Email) | |
| If you believe you have found a security vulnerability, please report it to us by emailing **security@example.com**. | |
| When reporting, please include: | |
| - A description of the vulnerability and its potential impact | |
| - Steps to reproduce (proof-of-concept, scripts, or screenshots if possible) | |
| - The affected version(s) and any relevant configuration details | |
| - Any available logs or error messages that help us understand the issue | |
| **Response and updates** | |
| - We aim to acknowledge receipt of your report within **3 business days**. | |
| - We will provide you with updates at key stages: when the issue is confirmed, when a fix is in development, and when a fix is released. | |
| **Triage process** | |
| - We review and validate the report to confirm the vulnerability. | |
| - We assess severity and impact to prioritize remediation. | |
| - We develop, test, and prepare a fix or mitigation. | |
| - We coordinate disclosure with you, and we may credit you in release notes if you wish and if appropriate. |
| declined, etc. | ||
|
|
||
| *this section can be edited only by the original creator since i dont have access to this info* | ||
| Contact Info: (DEMO EMAIL aka TOBIAS EMAIL, OR EXTENSION Email) |
There was a problem hiding this comment.
Inconsistent capitalization in the placeholder text. "DEMO EMAIL", "TOBIAS EMAIL" are in all caps while "Email" in "EXTENSION Email" has mixed case. If this placeholder text must remain temporarily, it should have consistent formatting.
| Contact Info: (DEMO EMAIL aka TOBIAS EMAIL, OR EXTENSION Email) | |
| Contact Info: (DEMO EMAIL aka TOBIAS EMAIL, OR EXTENSION EMAIL) |
| declined, etc. | ||
|
|
||
| *this section can be edited only by the original creator since i dont have access to this info* | ||
| Contact Info: (DEMO EMAIL aka TOBIAS EMAIL, OR EXTENSION Email) |
There was a problem hiding this comment.
The SECURITY.md file is critical for establishing trust and providing a secure channel for vulnerability disclosure. Having placeholder text or incomplete information in this file could discourage security researchers from reporting vulnerabilities or lead to reports being sent through insecure channels. This file should be complete with actual contact information and clear reporting procedures before being merged.
| Contact Info: (DEMO EMAIL aka TOBIAS EMAIL, OR EXTENSION Email) | |
| To report a security vulnerability, please use the "Report a vulnerability" link on this repository's Security tab or email our security team at security-reports@example.org. |
1 participant
Please Change the email. Instructions is in the script. Thanks.