Missing Security policy

[abnara]

I wanted to know if there is a way to submit security issues. There is no Security.md file in the repo. This is a requirement for me to be able to use the product. Are there plans to add a security policy?

[mikkelfj]

This is not exactly what you are asking for, but there is: https://github.com/dvidelabs/flatcc/blob/master/doc/security.md

There are no plans to add a security policy as there has been no pressing need. But it is possible to contact repo owner (me) directly by email, just look it up.

I don't feel like setting up a dedicated email for this, but you have any suggestions be my guest.
There have historically been a few issues that could have warranted a CVE alert but they have been fixed timely and https://github.com/dvidelabs/flatcc/blob/master/CHANGELOG.md is the best place to stay on top of issues.

[abnara]

Thanks for the quick reply :)
Maybe a Security.md can be committed with these 3 sections:

1. Security Policy (link to the other security.md document you mentioned)
2. Supported Versions
3. Reporting a vulnerability (mention repo owner email)

I know all this information already exists in different parts of the repo., but would help create some sort of “official” security policy.

[abnara]

Hi @mikkelfj
Any thoughts on my suggestion?

[mikkelfj]

Thanks for following up. These are reasonable suggestions.I think I might consider adding a SECURITY.md file, but then again, security is already referenced in the README, so I think that unless I set up a specific email address, it would not add much. For now I'm happy that my email is discoverable without being blatantly obvious.

As to supported versions, there aren't really any unsupported versions, but due to CI builds, the latest should work on a very large range of systems while being backwards compatible, so there isn't really much motivation for sticking with an older version, unless for code review reasons. If there is a specific concern in that regard, I'd advise looking through the change list and consider patching important fixes. If that is insufficient, open an issue, I'll see what can be done. If that is insufficient, consulting could be an option.

Feel free to use this issue as reference for internal documentation.

I will convert this it a discussion.