security reports?

[jtnord]

I think I found a security issue (could be in our fork but doesn't yet seem like it).

I could not find anywhere mentioning reporting security issues privately, can you please add some details?

Expected Behavior

If I find a security issue in the project I can go to the repo and find some info on how to report it.

Current Behavior

I am left guessing.

Possible Solution

create a file security.md with details of how to report security vulnerabilities, link to it from readme.md

Steps to Reproduce (for bugs)

Context

potentially report a security issue (if confirmed it is not a mess up in our fork or my configuration)

Your Environment

hey I got this building on windows woot!

• Version used:

[JoelSpeed]

This needs fixing and I am currently trying to work out how I want to handle this, I need to speak to our internal support team who currently handle most security issues for Pusher owned projects.

For now, could you please email me directly joel[at]pusher.com and I will look into the issue you have found.

[jtnord]

email sent :)

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[JoelSpeed]

We still need to work out how security reports should be handled. As a note, if anyone finds this, please do not email my pusher address, I no longer work for Pusher and I will not receive it

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[Aishwer-chegg]

@JoelSpeed @jtnord The security issue discussed here is not very clear. Is this still relevant? If yes, can you share more details for the same.

[jtnord]

this is still valid. there are no details on how to report security issues for this repo.

[JoelSpeed]

Agreed. I or one of the other maintainers needs to find some time to create a SECURITY.md doc that explains what users should do if they do find any vulnerabilities and what our responsibilities are in these cases

[Aishwer-chegg]

@jtnord @JoelSpeed Can you share how severe is the issue ? and What is the plan to fix this or Is there a patched version available ?

[JoelSpeed]

There are no outstanding issues for security here. We are just using this issue to track the fact that we haven't documented how to report security issues.

Please use the latest releases to ensure you have up to date security patches

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.