threads / discuss / 36454

security vulnerability disclosure procedure?

Subject: security vulnerability disclosure procedure?

## tl;dr

2 messages between Apr 20, 2014 and Apr 21, 2014.

replies: 1people: 2as markdown or json

Richard Hansen· Apr 20, 2014, 20:42 UTC · lore

Hi all,

I have discovered a minor security vulnerability. I could send the patch to the mailing list, but I wanted someone else to take a look first just to make sure it's minor enough that folks will think it's OK to publicly announce.

Who should I send the patch to?

Thanks, Richard

Shawn Pearce· Apr 21, 2014, 18:07 UTC · re: Richard Hansen · lore

Re: security vulnerability disclosure procedure?

On Sun, Apr 20, 2014 at 1:42 PM, Richard Hansen <rhansen@bbn.com> wrote:

Show 6 quoted lines

> I have discovered a minor security vulnerability.  I could send the
> patch to the mailing list, but I wanted someone else to take a look
> first just to make sure it's minor enough that folks will think it's OK
> to publicly announce.
>
> Who should I send the patch to?

Previous issues were routed through the maintainer, Junio directly (CC'd).