From d6ed552204000cc7063613b9d5728425711f4df8 Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Wed, 26 Aug 2026 14:34:41 +0200 Subject: [PATCH] Publish the held-back window where a reporter reads it SECURITY.md said nothing about how long this board holds back its own record of a flaw it found in somebody else's software. Record 0022 decides 90 days from the report and one written extension on a reasoned request, and names SECURITY.md as where that window is published. Until now it existed only in the decision record, which is not a file a reporter or an affected project reads, so the window a project is entitled to plan against was invisible to it. The paragraphs go into the section about an experiment that finds a flaw in shipped software, because record 0010 already stands there and the window is the continuation of that rule. They point at record 0022 for the reasoning and the rejected options rather than restating either, so the copy cannot drift against the decision that a reader would find second. The second paragraph separates the window from the sentence under "What a reporter gets" saying there is no response deadline. Those two run in opposite directions and both stand: one is about a report arriving here, the other about a report leaving here. Without the separation written down, a reader meeting both reads the file as contradicting itself and has to guess which sentence governs. Closes #194 Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- SECURITY.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 041944c..73bcdf7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -104,6 +104,28 @@ while asking a different question, which is the common case. The work stops and the report goes to them. What comes back here afterwards is the record, once the flaw is fixed and the affected project has said what it wants said. +How long that record waits is 90 days from the report, and it is published at +the end of them whether or not the fix and the statement have arrived. Waiting +on those two indefinitely would hand the schedule to whoever is slowest to +reply, and it would leave this board holding a record of a real finding that +nobody outside knows exists. There is exactly one extension, granted on a +reasoned request and written down, because a date fixed 90 days before anybody +had looked at the flaw is sometimes the wrong date for it, and moving that date +should be a choice somebody took rather than a slip. The reasoning, and what +each rejected option would have cost, is in +[decision record 0022](docs/decisions/0022-how-long-a-held-back-record-waits.md) +and is not restated here. Where the affected project publishes its own +disclosure policy and this board has reported into it, the earlier of the two +dates is the one that binds here. + +That window is not a deadline anybody reporting to this board gets, and it is +not the sentence under "What a reporter gets" below saying there is no response +deadline. The two run in opposite directions and both stand. That one is about a +report arriving here, and how long a reporter waits for an answer from me. The +90 days are about a report leaving here, and how long this board holds back its +own record of a flaw it found in somebody else's software. A window on what this +board owes others is not a promise about what others may expect from it. + A problem in Jellyfin itself belongs to [the Jellyfin project](https://github.com/jellyfin/jellyfin/security/policy). A report that lands here instead is pointed the right way rather than closed.