Who to contact for security issues

[JamieSlome]

Hey there!

I belong to an open source security research community, and a member (@Nav-Prak) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

[pentium10]

use my username to G mail to send email regarding this repo

[JamieSlome]

@pentium10 - we can currently only give report access to @ptrofimov as it is a user-based repository, instead of an organization. Is @ptrofimov still actively contributing?

For reference, the report can be found here:

https://huntr.dev/bounties/9af1c35e-3f74-4c93-a241-e8be01335ec7/

[pentium10]

He is not active at all. In the last 5 years I've committed all the updates, check out the recent commits.

[JamieSlome]

@pentium10 - you should have just received an e-mail from us, cheers! 🎉

[pentium10]

received it

[JamieSlome]

@pentium10 - great 👍

[pentium10]

this has been addressed by #181