luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs/SECURITY-PROCESS.md: updates

Browse Source 
- allow Low+Medium issues to be managed through plain PRs
- update the bug-bounty part to reflect current reality

Closes #10719
This commit is contained in:
Daniel Stenberg 2023-03-09 13:39:23 +01:00
parent 37a3c63427
commit 56f306a5a6
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
docs/SECURITY-PROCESS.md
View File

@ -63,10 +63,14 @@ announcement.
- Update the "security advisory" with the CVE number.
- The security team commits the fix in a private branch. The commit message
should ideally contain the CVE number.
should ideally contain the CVE number. If the severity level of the issue is
set to Low or Medium, the fix is allowed to get merged into the master
repository via a normal PR - but without mentioning it being a security
vulnerability.
- The security team also decides on and delivers a monetary reward to the
reporter as per the bug-bounty policies.
- The monetary reward part of the bug-bounty is managed by the Internet Bug
Bounty team and the reporter is asked to request the reward from them after
the issue has been completely handled and published by curl.
- No more than 10 days before release, inform
[distros@openwall](https://oss-security.openwall.org/wiki/mailing-lists/distros)