[GHSA-qrg7-hfx7-95c5] Please correct the credit for the advisory

[macedogm]

Following #1683, the global advisory GHSA-qrg7-hfx7-95c5 was wrongly credited to aruneko. The local (repository level) advisory GHSA-qrg7-hfx7-95c5 was credited to a security researcher, which hasn't yet accepted the credit in its GH profile. I'm requesting such correction in order to be transparent with the person that actually reported the issue.

[KateCatlin]

@macedogm thanks for writing in and apologies for the confusion here.

We automatically credit anyone who submits a community contribution to improve an advisory. However, this has caused consternation (such as this issue) due to the lack of differentiation between types of credits.

As such, we'll soon be releasing a new feature allowing for different types of credits on advisories. Researchers will be able to be credited as the discovering party, and contributors will be credited separately.

Does that resolve your concern?

[macedogm]

Hi @KateCatlin. Thank you for the context and explanation. Yes, that will resolve my concern. Just to reiterate, I created this issue to be fair with the discovering party and not to be unfair with the contributor party. The improvement that you mentioned will be a nice one for this. Feel free to close this issue.

[KateCatlin]

@macedogm perfect thank you so much! Glad we've resolved it for you. I'll go ahead and close this, keep an eye on our changelog for the upcoming credit differentiation release.