💬 Discussion | Add Security Policy (SECURITY.MD) #988

New Issue

2019-06-14T18:19:42Z

ghost commented

2019-06-14 18:19:42 +00:00

(Migrated from github.com)

Since privacytools.io has somewhat recently become a service provider, I suggest we have an official bug reporting policy.

I know we entirely/mostly host existing projects, but it is possible we could have misconfigurations in the server or hosted software. Since we are handling private information, we should have an avenue for people to report issues.

Github supports adding a security policy file to projects: see docs on this. The policy would be visible in the file and here

Secondarily, I suggest we add a security.txt file on the main website, which is a recent standard. I could see an argument to not add this file because it arguably results in few productive reports, as indicated by this hacker news discussion

Obviously, a few things would have to be out of scope:

excessive automated scanning
denial of service
user's accounts
social engineering
infrastructure PTIO is not in control of

@JonahAragon

Since privacytools.io has somewhat recently become a service provider, I suggest we have an official bug reporting policy. I know we entirely/mostly host existing projects, but it is possible we could have misconfigurations in the server or hosted software. Since we are handling private information, we should have an avenue for people to report issues. Github supports adding a security policy file to projects: [see docs on this](https://help.github.com/en/articles/adding-a-security-policy-to-your-repository). The policy would be visible in the file and [here](https://github.com/privacytoolsIO/privacytools.io/security/policy) Secondarily, I suggest we add a [security.txt](https://securitytxt.org/) file on the main website, which is a recent standard. I could see an argument to not add this file because it arguably results in few productive reports, as indicated by [this hacker news discussion](https://news.ycombinator.com/item?id=19151213) Obviously, a few things would have to be out of scope: * excessive automated scanning * denial of service * user's accounts * social engineering * infrastructure PTIO is not in control of @JonahAragon

This repo is archived. You cannot comment on issues.