Skip to content

Latest commit

 

History

History
16 lines (13 loc) · 905 Bytes

A-security-disclosure-procedure.md

File metadata and controls

16 lines (13 loc) · 905 Bytes
Raw

Security issue disclosure procedure

If you think that you have found a security issue in flysystem-bundle, don't use the bug tracker and don't publish it publicly. Instead, all security issues must be sent to galopintitouan [at] gmail.com.

For each report, the core maintainers of flysystem-bundle will first try to confirm the vulnerability. When it is confirmed, we will work on a solution following these steps:

  1. Send an acknowledgement to the reporter;
  2. Work on a patch in a dedicated private repository;
  3. Get a CVE identifier from mitre.org;
  4. Send the patch to the reporter for review;
  5. Apply the patch to all maintained versions of flysystem-bundle;
  6. Package new versions for all affected versions;
  7. Update the public security advisories database maintained by the FriendsOfPHP organization.