Create SECURITY.md

[JamieSlome]

Hey there!

I belong to an open source security research community, and a member (@AiDaiP) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

[rbouqueau]

Hi @JamieSlome, thank you.

If you plan to report issues found by a fuzzer, our preference is that you open a public issue. Otherwise feel free to send us an email at security@gpac.io.

We'll discuss among maintainers about adding the SECURITY.md file. Github recommendations seem more complete than last time I checked, thanks for the link.

[aureliendavid]

added SECURITY.md with basic info

[JamieSlome]

Hello, @rbouqueau @aureliendavid for the responses!

You should have received multiple e-mails to the address you added to your SECURITY.md.

For reference, the reports are:

https://huntr.dev/bounties/e055098a-5909-4bec-8b7f-ab0dbb703dbf/
https://huntr.dev/bounties/0758b3a2-8ff2-45fc-8543-7633d605d24e/
https://huntr.dev/bounties/1691cca3-ab54-4259-856b-751be2395b11/

All reports are private and can only be accessed by the magic link sent in the e-mails, or you can view the reports if you have repository write permissions.

[rbouqueau]

Hello @JamieSlome Happy new year!

Can the magic links you sent us by email made public if we'd like to?

[JamieSlome]

@rbouqueau - a happy new year to you too! 🎉

The magic links are not to be shared, as they provide maintainer controls which should only be used by maintainers or contributors with write permissions.

If you would like the reports to be public, we can arrange this for you. LMK ❤️

[rbouqueau]

On our wishlist it would ideal if we could change the visibility of the report once we have internally reviewed it. Even better: once we change the visibility to public, it becomes a github public issue!

Thanks again!

[JamieSlome]

@rbouqueau - awesome ideas and we would love to keep them tracked!

I'd love to invite you to create an issue on our GitHub repo: https://github.com/418sec/huntr/issues/new

Tell us about your feature request and a member from our team will get round to responding!

Just to confirm, would you like me to make the reports publicly visible now? 🤝

[rbouqueau]

Done. Thank you so much!

[JamieSlome]

@rbouqueau - looks like the e-mails went out but they soft-bounced.

Can you confirm if you have received the magic URLs?

[aureliendavid]

we've received the emails but some addresses on our list are misconfigured so might bounce

it is being fixed atm

[rbouqueau]

@JamieSlome Thanks for touching base. This just confirms that dealing with emails for an entity like us is not efficient. I think the text in the security.md makes it clear.

I hope your organization will be able to implement 418sec/huntr#2188! FYI see #2050 #2051 and #2052 for the issue that your community raised.

[JamieSlome]

@rbouqueau - thanks for the update. Will just (cc) @psmoros into this conversation for tracking purposes of the demand for the feature request.

[rbouqueau]

@JamieSlome Once the issues are fixed, what is expected from us on your platform?

[aureliendavid]

I've marked issues as confirmed and fixed on huntr.dev using the magic links

[JamieSlome]

@aureliendavid thanks 👋

That is all now!