# security vulnerability disclosure procedure?

2 messages from 2014-04-20 to 2014-04-21. Participants: Richard Hansen, Shawn Pearce.
Thread: https://gitlist.dev/t/36454

## Richard Hansen, 2014-04-20 20:42

Subject: security vulnerability disclosure procedure?
Message-ID: <53543121.3000808@bbn.com>
URL: https://gitlist.dev/e/53543121.3000808%40bbn.com

```
Hi all,

I have discovered a minor security vulnerability.  I could send the
patch to the mailing list, but I wanted someone else to take a look
first just to make sure it's minor enough that folks will think it's OK
to publicly announce.

Who should I send the patch to?

Thanks,
Richard

```

## Shawn Pearce, 2014-04-21 18:07

Subject: Re: security vulnerability disclosure procedure?
Message-ID: <CAJo=hJsU7hLMwkvPMqM7J7Tj0svQzQwp8xXHRKr=Gp8W6j55dA@mail.gmail.com>
URL: https://gitlist.dev/e/CAJo%3DhJsU7hLMwkvPMqM7J7Tj0svQzQwp8xXHRKr%3DGp8W6j55dA%40mail.gmail.com
In-Reply-To: <53543121.3000808@bbn.com>

```
On Sun, Apr 20, 2014 at 1:42 PM, Richard Hansen <rhansen@bbn.com> wrote:
> I have discovered a minor security vulnerability.  I could send the
> patch to the mailing list, but I wanted someone else to take a look
> first just to make sure it's minor enough that folks will think it's OK
> to publicly announce.
>
> Who should I send the patch to?

Previous issues were routed through the maintainer, Junio directly (CC'd).

```