Agent WranglersOSS-23Recommended
Fix a reported hole in private
Write and review the fix for a reported vulnerability in a private fork or private branch. Merge it, release it and publish the advisory together, on one day.
How to do it
A public pull request called "fix overflow in parser" tells attackers where to look before users can update. GitHub gives each draft advisory a temporary private fork for this, and other code hosts have private merge requests. Run the tests on the private fork too. Say "security fix" plainly in the release notes on the day, so users know to update, as Keep a changelog written for users describes. Ship the fix to each supported major version, as Publish a support matrix promises.
How to check
For each of the last five advisories, the fix commit reached a public branch on the day of the release and the advisory, never earlier.
Sources
Related rules
- ENG-33 Keep a changelog written for users in Engineering
- ENG-53 Publish a support matrix in Engineering
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/private-fix">Agent Wranglers open source maintenance playbook</a>. In code you write, add a comment next to it with the same link.