Add Security Policy #1001

jonah · 2019-06-20T21:32:12Z

jonah commented

2019-06-20 21:32:12 +00:00

As recommended in #988:

Since privacytools.io has somewhat recently become a service provider, I suggest we have an official bug reporting policy.

This sounds good to me. I added some basic instructions to a security policy file, do you think this is enough or well-constructed? Let me know if anything should be added @beardog108.

Closes #988

As recommended in #988: > Since privacytools.io has somewhat recently become a service provider, I suggest we have an official bug reporting policy. This sounds good to me. I added some basic instructions to a security policy file, do you think this is enough or well-constructed? Let me know if anything should be added @beardog108. --- Closes #988

Mikaela (Migrated from github.com) reviewed 2019-06-20 21:32:12 +00:00

blacklight447 (Migrated from github.com) reviewed 2019-06-20 21:32:12 +00:00

netlify[bot] commented

2019-06-20 21:32:55 +00:00

(Migrated from github.com)

Deploy preview for privacytools-io ready!

Built with commit ad344be456

https://deploy-preview-1001--privacytools-io.netlify.com

Deploy preview for *privacytools-io* ready! Built with commit ad344be456504a6f309d860c1d280917f6f4f39d https://deploy-preview-1001--privacytools-io.netlify.com

ghost commented

2019-06-20 21:40:32 +00:00

(Migrated from github.com)

Thanks for adding. Looks pretty good, but i'd clarify that user & admin accounts not owned by the tester are out of scope as well.

👍 1

ghbjklhv (Migrated from github.com) reviewed 2019-06-21 22:09:48 +00:00

SECURITY.md

						
				@ -0,0 +20,4 @@

				* Reports against infrastructure outside our control

				* User or admin accounts not owned by the tester

				## Disclosure Policy

ghbjklhv (Migrated from github.com) commented

2019-06-21 22:09:48 +00:00

This does not seem to include if users will be informed in case data is leaked.

My understanding is that social.privacytools.io and other services collect information like email.
What happens if this information gets stolen? How would users be informed?

This does not seem to include if users will be informed in case data is leaked. My understanding is that social.privacytools.io and other services collect information like email. What happens if this information gets stolen? How would users be informed?

jonah reviewed 2019-06-22 00:14:07 +00:00

SECURITY.md

						
				@ -0,0 +20,4 @@

				* Reports against infrastructure outside our control

				* User or admin accounts not owned by the tester

				## Disclosure Policy