Agent WranglersOSS-22Recommended
Send private reports to at least two people
Turn on the code host's private vulnerability reporting, and name at least two security contacts in SECURITY.md. Each of them gets every new report.
How to do it
The security policy itself is set out in Publish a security policy with the code. This rule makes sure a report never waits for one person's holiday. On GitHub, turn on private vulnerability reporting in the repository's security settings, and have each contact watch the repository for security alerts. Name a shared address as well for reporters who do not use the code host. Triage and fix each report within the times in Fix each finding within the time its severity allows. When someone posts a hole in a public issue, hide the issue, thank them, and move the report into a private advisory.
How to check
gh api repos/example-shop/cart/private-vulnerability-reporting --jq .enabled prints true. SECURITY.md names at least two contacts. A test report each quarter reaches both of them.
Sources
Related rules
- ENG-44 Publish a security policy with the code in Engineering
- SEC-107 Fix each finding within the time its severity allows in Adversarial testing
- OSS-34 Ask for version and steps in every bug report in Open source maintenance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-contacts">Agent Wranglers open source maintenance playbook</a>. In code you write, add a comment next to it with the same link.