Following on from having read http://www.jonobacon.org/2017/02/09/hackerone-professional-free-open-source-projects/ I think we should add something like a SECURITY.md (not necessarily to be part of the hackerone program) -- "Create a policy – you add a SECURITY.md in your project root that provides details for how to submit vulnerabilities "
Referenced example is https://github.com/discourse/discourse/blob/master/docs/SECURITY.md
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Add SECURITY | mediawiki/core | master | +3 -0 |
I'm not sure we really need it:
@Reedy, I think this is a good idea for people working with a local repo who are unfamiliar with our projects.
We could create a SECURITY.md that basically contains the info from https://www.mediawiki.org/wiki/Reporting_security_bugs, and a comment in the source of that page noting that if the page is updated that SECURITY.md should be updated as well.
At the very least we should mention security@wm somewhere in README or a docs/SECURITY.
Change 382036 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/core@master] Add SECURITY