{"action":"created","issue":{"url":"https://api.github.com/repos/ipfs/community/issues/62","labels_url":"https://api.github.com/repos/ipfs/community/issues/62/labels{/name}","comments_url":"https://api.github.com/repos/ipfs/community/issues/62/comments","events_url":"https://api.github.com/repos/ipfs/community/issues/62/events","html_url":"https://github.com/ipfs/community/issues/62","id":113913180,"number":62,"title":"Security","user":{"login":"RichardLitt","id":910753,"avatar_url":"https://avatars.githubusercontent.com/u/910753?v=3","gravatar_id":"","url":"https://api.github.com/users/RichardLitt","html_url":"https://github.com/RichardLitt","followers_url":"https://api.github.com/users/RichardLitt/followers","following_url":"https://api.github.com/users/RichardLitt/following{/other_user}","gists_url":"https://api.github.com/users/RichardLitt/gists{/gist_id}","starred_url":"https://api.github.com/users/RichardLitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RichardLitt/subscriptions","organizations_url":"https://api.github.com/users/RichardLitt/orgs","repos_url":"https://api.github.com/users/RichardLitt/repos","events_url":"https://api.github.com/users/RichardLitt/events{/privacy}","received_events_url":"https://api.github.com/users/RichardLitt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-28T20:18:09Z","updated_at":"2015-11-02T00:56:16Z","closed_at":null,"body":"#### What\r\n\r\n**We should be more prominent about how we deal with security issues**. Currently, there is a security section in the CONTRIBUTING.md file in this repo. It is the first section, and all IPFS repositories ought to point to this file, anyway - however, they currently do so by linking through their own contribute files, which adds friction for anyone who might have a security concern to follow.\r\n\r\nI'm not sure that this is good enough. We could add a Security.md file, and link to it. I suggested this to some people early today, but after an extensive search, I couldn't find any one else who really does this on GitHub, which means that it is unlikely people will be looking for it. As well, I think that security concerns can really be summed up in only one paragraph, and are unlikely to change.  I think a better solution is to do what [Docker does](https://github.com/docker/docker). Immediately under the description of Docker in their main Readme.md they have a Security Disclosure section, outlining that no issues should be opened which might compromise current versions.  \r\n\r\n#### Suggested Next steps\r\n\r\n* Add a security section to ipfs/go-ipfs/CONTRIBUTING.md. \r\n* Add a security section to ipfs/ipfs/README.md.\r\n* Add a security section to ipfs/go-ipfs/README.md.\r\n\r\nI may be wrong about the security section changing. If so, we can link to a Security.md in this repo. Here is the current section, in it's entirety: \r\n\r\n> #### Security Issues\r\n\r\n> The IPFS protocol and its implementations are still in heavy development. This means that there may be problems in our protocols, or there may be mistakes in our implementations. And -- though IPFS is not production-ready yet -- many people are already running nodes in their machines. So we take security vulnerabilities very seriously. If you discover a security issue, please bring it to our attention right away!\r\n\r\n> If you find a vulnerability that may affect live deployments -- for example, expose a remote execution exploit -- please send your report privately to juan@ipfs.io, please DO NOT file a public issue.\r\n\r\n> If the issue is a protocol weakness or something not yet deployed, just discuss it openly."},"comment":{"url":"https://api.github.com/repos/ipfs/community/issues/comments/152884309","html_url":"https://github.com/ipfs/community/issues/62#issuecomment-152884309","issue_url":"https://api.github.com/repos/ipfs/community/issues/62","id":152884309,"user":{"login":"jbenet","id":138401,"avatar_url":"https://avatars.githubusercontent.com/u/138401?v=3","gravatar_id":"","url":"https://api.github.com/users/jbenet","html_url":"https://github.com/jbenet","followers_url":"https://api.github.com/users/jbenet/followers","following_url":"https://api.github.com/users/jbenet/following{/other_user}","gists_url":"https://api.github.com/users/jbenet/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenet/subscriptions","organizations_url":"https://api.github.com/users/jbenet/orgs","repos_url":"https://api.github.com/users/jbenet/repos","events_url":"https://api.github.com/users/jbenet/events{/privacy}","received_events_url":"https://api.github.com/users/jbenet/received_events","type":"User","site_admin":false},"created_at":"2015-11-02T00:56:16Z","updated_at":"2015-11-02T00:56:16Z","body":":+1: to doing what Docker does, and to your suggestions. \r\n\r\nI can setup `security@ipfs.io` too-- let's use that. "}}