romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 04:57:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

VULN-DISCLOSURE-POLICY.md: mention GitHub quirks

Browse source 
Closes #20541
This commit is contained in:
Daniel Stenberg 2026-02-07 23:45:27 +01:00
parent 950c7bb174
commit 15a8a777b8
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/VULN-DISCLOSURE-POLICY.md
View file

@ -99,6 +99,23 @@ announcement.
- The security webpage on the website should get the new vulnerability
mentioned.
## GitHub Advisories
We receive *advisories* submitted on GitHub but we consider them to be
*reports*. Since we want to keep the original report as-is and preserved, we
cannot use this system to author nor publish the actual final advisory for a
confirmed vulnerability.
The security reports submitted on GitHub are not published, instead they are
always closed weather confirmed or not.
Confirmed security reports are instead published as security advisories on the
curl website in sync with the curl release in which the fix is published for
the vulnerability.
Unfortunately, GitHub does not allow us to disclose the reports. They can only
be published as "advisories" - and they are not.
## security (at curl dot se)
This is a private mailing list for discussions on and about curl security