github: improve security policy documentation #4130
Conversation
Fixes grpc#4128 This is largely inspired by https://github.com/envoyproxy/envoy. For an example of the end result and how it shows up in the Github UI, check out https://github.com/envoyproxy/envoy/issues/new/choose (comes from the ISSUE_TEMPLATE change) and https://github.com/envoyproxy/envoy/security/policy.
There was a problem hiding this comment.
Interesting. Envoy also has this in their bug template; perhaps we should do something similar:
If you are reporting any crash or any potential security issue, do not open an issue in this repo. Please report the issue via emailing envoy-security@googlegroups.com where the issue will be triaged appropriately.
.github/SECURITY.md
Outdated
| @@ -0,0 +1,3 @@ | |||
| # Security Policy | |||
There was a problem hiding this comment.
Did you intend to put this in the root directory instead?
There was a problem hiding this comment.
it can go in either and still work (see https://github.com/istio/istio/security/policy). So whatever you prefer
There was a problem hiding this comment.
Aha. Let's put it in the root directory so it's more visible. Thank you.
One other thing, Envoy has a very clear stance that ALL crashes should be privately reported. I wasn't sure of gRPCs stance on that so I left out the language, but can add it back if desired. |
I'm not sure our stance, either. 😄 I'll ask around. For now we can leave that language out -- I was just referring to the general idea of a comment in the issue template explaining that potential security issues shouldn't be filed as github issues. |
|
IIUC, this will result in two new buttons under "new issue": one saying "Report a Security Vulnerability" and one saying "Potentional security vulnerability". I am thinking we shouldn't include the |
dfawley
changed the title
Yes, I think that is right. I think the "Report a Security Vulnerability" one is new, I don't recall seeing that previously. In any event, looks like just SECURITY.md is sufficient |
Fixes #4128
This is largely inspired by https://github.com/envoyproxy/envoy. For an
example of the end result and how it shows up in the Github UI, check
out https://github.com/envoyproxy/envoy/issues/new/choose (comes from
the ISSUE_TEMPLATE change) and
https://github.com/envoyproxy/envoy/security/policy.