{"action":"created","issue":{"url":"https://api.github.com/repos/balderdashy/sails/issues/2830","labels_url":"https://api.github.com/repos/balderdashy/sails/issues/2830/labels{/name}","comments_url":"https://api.github.com/repos/balderdashy/sails/issues/2830/comments","events_url":"https://api.github.com/repos/balderdashy/sails/issues/2830/events","html_url":"https://github.com/balderdashy/sails/issues/2830","id":67645683,"number":2830,"title":"Write and publish responsible disclosure policy","user":{"login":"kevinburkeshyp","id":10735057,"avatar_url":"https://avatars.githubusercontent.com/u/10735057?v=3","gravatar_id":"","url":"https://api.github.com/users/kevinburkeshyp","html_url":"https://github.com/kevinburkeshyp","followers_url":"https://api.github.com/users/kevinburkeshyp/followers","following_url":"https://api.github.com/users/kevinburkeshyp/following{/other_user}","gists_url":"https://api.github.com/users/kevinburkeshyp/gists{/gist_id}","starred_url":"https://api.github.com/users/kevinburkeshyp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kevinburkeshyp/subscriptions","organizations_url":"https://api.github.com/users/kevinburkeshyp/orgs","repos_url":"https://api.github.com/users/kevinburkeshyp/repos","events_url":"https://api.github.com/users/kevinburkeshyp/events{/privacy}","received_events_url":"https://api.github.com/users/kevinburkeshyp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/balderdashy/sails/labels/needs%20documentation","name":"needs documentation","color":"bfdadc"},{"url":"https://api.github.com/repos/balderdashy/sails/labels/needs%20review","name":"needs review","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"irlnathan","id":1598650,"avatar_url":"https://avatars.githubusercontent.com/u/1598650?v=3","gravatar_id":"","url":"https://api.github.com/users/irlnathan","html_url":"https://github.com/irlnathan","followers_url":"https://api.github.com/users/irlnathan/followers","following_url":"https://api.github.com/users/irlnathan/following{/other_user}","gists_url":"https://api.github.com/users/irlnathan/gists{/gist_id}","starred_url":"https://api.github.com/users/irlnathan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/irlnathan/subscriptions","organizations_url":"https://api.github.com/users/irlnathan/orgs","repos_url":"https://api.github.com/users/irlnathan/repos","events_url":"https://api.github.com/users/irlnathan/events{/privacy}","received_events_url":"https://api.github.com/users/irlnathan/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-04-10T17:38:37Z","updated_at":"2015-04-14T02:08:36Z","closed_at":null,"body":"- If I find a critical vulnerability in Sails how should I communicate it to the core team? \r\n- What guarantees are given about time to a patch? \r\n- Will reporters be credited for their work in finding a vulnerability?\r\n- How are critical security vulnerabilities disclosed to the community? \r\n- Are vulnerabilities given a CVE number? \r\n- Once you write a page like this, [how can I be expected to find it][broken]?\r\n\r\n[broken]: https://github.com/balderdashy/sails/issues/2594\r\n\r\nHere is an example of what a page like this should look like: http://docs.python-requests.org/en/latest/community/vulnerabilities/"},"comment":{"url":"https://api.github.com/repos/balderdashy/sails/issues/comments/92561565","html_url":"https://github.com/balderdashy/sails/issues/2830#issuecomment-92561565","issue_url":"https://api.github.com/repos/balderdashy/sails/issues/2830","id":92561565,"user":{"login":"kevinburkeshyp","id":10735057,"avatar_url":"https://avatars.githubusercontent.com/u/10735057?v=3","gravatar_id":"","url":"https://api.github.com/users/kevinburkeshyp","html_url":"https://github.com/kevinburkeshyp","followers_url":"https://api.github.com/users/kevinburkeshyp/followers","following_url":"https://api.github.com/users/kevinburkeshyp/following{/other_user}","gists_url":"https://api.github.com/users/kevinburkeshyp/gists{/gist_id}","starred_url":"https://api.github.com/users/kevinburkeshyp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kevinburkeshyp/subscriptions","organizations_url":"https://api.github.com/users/kevinburkeshyp/orgs","repos_url":"https://api.github.com/users/kevinburkeshyp/repos","events_url":"https://api.github.com/users/kevinburkeshyp/events{/privacy}","received_events_url":"https://api.github.com/users/kevinburkeshyp/received_events","type":"User","site_admin":false},"created_at":"2015-04-14T02:08:36Z","updated_at":"2015-04-14T02:08:36Z","body":"Not necessarily asking you to guarantee some kind of SLA. \r\n\r\nI'm just asking for, like, if someone comes to you with \"here is a query string that will crash the Node process for every sails user\" or \"I found a SQL injection attack that will own anyone that's using waterline\", if that person doesn't hear back from you, they are going to get antsy, worry that someone else will find it/exploit it, possibly decide to go public before a patch has been prepared, etc.\r\n\r\nI know open source is a volunteer thing, but, I don't think \"we will respond to your security disclosure within 14|30|60|N days\" is unreasonable."}}