Document how to report a security vulnerability

[edmorley]

I have an issue that I believe should be reported non-publicly (it may end up being deemed safe enough to report via GitHub but I'd rather ask first), however I couldn't find a security bug reporting process documented on any of:
https://github.com/webpack/webpack/blob/master/README.md
https://github.com/webpack/webpack/blob/master/CONTRIBUTING.md
https://webpack.js.org/support/
https://webpack.js.org/development/

Please could a process be created/documented?

Thanks!

[sokra]

You can send me a mail.

[webpack-bot]

This issue had no activity for at least half a year.

It's subject to automatic issue closing if there is no activity in the next 15 days.

[edmorley]

.

[webpack-bot]

This issue had no activity for at least half a year.

It's subject to automatic issue closing if there is no activity in the next 15 days.

[edmorley]

.

[alexander-akait]

/cc @sokra can we integrate webpack.js.org with Google Business Email and create security@webpack.js.org email? Also create SECURITY.md with contents:

# Reporting Security Issues

If you discover a security issue in webpack, please report it by sending an
email to [security@webpack.js.org](security@webpack.js.org).

This will allow us to assess the risk, and make a fix available before we add a
bug report to the GitHub repository.

Thanks for helping make webpack safe for everyone.

[alexander-akait]

BTW we can add this file right now with you public email

[TheLarkInn]

Also you can reach out to webpack@opencollective.com which will go to all maintainers.

[edmorley]

Many thanks :-)

[webpack-bot]

For maintainers only:

• webpack-4
• webpack-5
• bug
• critical-bug
• enhancement
• documentation
• performance
• dependencies
• question