Skip to content

Update security policy#211

Open
k9withabone wants to merge 3 commits intomainfrom
security-policy
Open

Update security policy#211
k9withabone wants to merge 3 commits intomainfrom
security-policy

Conversation

@k9withabone
Copy link
Copy Markdown
Member

Added MAINTAINERS.md with contact information for the Podlet maintainers.

Changed SECURITY.md to direct security vulnerability reports to the Podlet maintainers.

Closes: #183

Added `MAINTAINERS.md` at the request of the Podman maintainers. It
contains contact information for reporting security vulnerabilities if
the reporter does not have a GitHub account.

Signed-off-by: Paul Nettleton <k9@k9withabone.dev>
Changed the security policy at the request of the Podman maintainers to
direct security vulnerability reports to the Podlet maintainers.

Closes: #183
Signed-off-by: Paul Nettleton <k9@k9withabone.dev>
@k9withabone k9withabone added this to the v0.3.2 milestone Apr 25, 2026
@k9withabone k9withabone added the documentation Improvements or additions to documentation label Apr 25, 2026
@k9withabone
Copy link
Copy Markdown
Member Author

@Luap99 does the new security policy look good to you? I'll copy it over to compose_spec_rs (with the relevant modifications) once it is merged here.

Copy link
Copy Markdown
Member

@Luap99 Luap99 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure, LGTM. Thank you!

Comment thread SECURITY.md Outdated

If you have identified a security vulnerability in the Podlet project, please **do not** report the
issue publicly via GitHub issues, mailing list, Discord, etc. Instead, use the
[private security vulnerability reporting](https://github.com/containers/podlet/security) on GitHub
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a bit of a circular loop and just points to this page. Maybe be a bit more explicit? If you take this suggestion, take the line above too. It's a two-for-one deal.

Suggested change
[private security vulnerability reporting](https://github.com/containers/podlet/security) on GitHub
"Report a vulnerability button on the [private security vulnerability reporting](https://github.com/containers/podlet/security) page on GitHub

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review and suggestions! Does it make more sense now?

podlet/SECURITY.md

Lines 3 to 9 in 7d86818

## Reporting a Vulnerability
If you have identified a security vulnerability in the Podlet project, please **do not** report the
issue publicly via GitHub issues, mailing list, Discord, etc. Instead, use GitHub's private
security vulnerability reporting feature by pressing the "Report a vulnerability" button on the
repository's [security](https://github.com/containers/podlet/security) page or privately contact one
or more of the [maintainers](./MAINTAINERS.md).

podlet/MAINTAINERS.md

Lines 3 to 5 in 7d86818

Podlet is a community project maintained by volunteers. They may be contacted directly in case of a security vulnerability.
However, if possible, please use GitHub's private security vulnerability reporting feature by pressing the "Report a vulnerability" button on the repository's [security](https://github.com/containers/podlet/security) page.
For all other communication, please use one of the [communication channels](./README.md#Communication).

Comment thread SECURITY.md Outdated
## Reporting a Vulnerability

If you have identified a security vulnerability in the Podlet project, please **do not** report the
issue publicly via GitHub issues, mailing list, Discord, etc. Instead, use the
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See next

Suggested change
issue publicly via GitHub issues, mailing list, Discord, etc. Instead, use the
issue publicly via GitHub issues, mailing list, Discord, etc. Instead, press the

@TomSweeneyRedHat
Copy link
Copy Markdown
Member

I really like where this is going, just a few suggestions to make it a bit more explicit.

Changed the wording in `SECURITY.md` and `MAINTAINERS.md` to be more
explicit in how to report a vulnerability (press the "Report a
vulnerability" button).

Signed-off-by: Paul Nettleton <k9@k9withabone.dev>
Copy link
Copy Markdown
Member

@TomSweeneyRedHat TomSweeneyRedHat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
TYVM for the changes!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Change Security Policy to Direct to Podlet Maintainers and Add Maintainers List

3 participants