Security Vulnerability Disclosure

[pr0f94]

Hi, I would like to report a security vulnerability in Parcel but it appears that you don't have a security policy mentioned anywhere; you have also not enabled GitHub's private disclosure option. What is the best way to disclose this?

[MLuc24]

Your reading is right, and it's worse than just a missing file. I checked the three places a policy would live and all three 404:

• parcel-bundler/parcel root SECURITY.md
• parcel-bundler/parcel .github/SECURITY.md
• the org-wide parcel-bundler/.github repo

/repos/parcel-bundler/parcel/security-advisories also returns an empty list, so no advisory has ever been published here either. There's no documented channel and no track record of one being used.

Given that, the lowest-friction thing is probably to ask, in the open and without details, for private reporting to be switched on. It's a repo setting rather than a process anyone has to design — once enabled, "Report a vulnerability" appears on the Security tab and you get a private thread with the maintainers. Framing the ask that way tends to move faster than asking someone to write a policy.

npm's own guidance for this situation is to go to the maintainers directly:

Vulnerabilities in npm packages should be reported directly to the package maintainers. We strongly advise doing this privately.

and npm owner ls parcel will give you the list to work from if you'd rather not wait.

Worth separating the two cases, since npm treats them differently: a vulnerability goes to maintainers as above, but if what you found is malicious code rather than a flaw, npm's package page has a Report malware form that goes to npm rather than to the maintainer — that path exists regardless of whether this repo ever adds a policy.