# Where is the best place to report a security vulnerability in git? 4 messages from 2014-11-27 to 2014-11-27. Participants: Hugh Davenport, Jonathan Nieder, Sitaram Chamarty. Thread: https://gitlist.dev/t/38064 ## Hugh Davenport, 2014-11-27 00:49 Subject: Where is the best place to report a security vulnerability in git? Message-ID: <175a570ee03dba2828cb7e129c9445c9@davenport.net.nz> URL: https://gitlist.dev/e/175a570ee03dba2828cb7e129c9445c9%40davenport.net.nz ``` ``` ## Jonathan Nieder, 2014-11-27 01:20 Subject: Re: Where is the best place to report a security vulnerability in git? Message-ID: <20141127012053.GU6527@google.com> URL: https://gitlist.dev/e/20141127012053.GU6527%40google.com In-Reply-To: <175a570ee03dba2828cb7e129c9445c9@davenport.net.nz> ``` Hi Hugh, Hugh Davenport wrote: > Where is the best place to report a security vulnerability in git? Current practice is to contact Junio C Hamano . Cc-ing Jeff King isn't a bad idea while at it. We should probably set up a mailing list to make this more obvious, but that's what we have today. Thanks, Jonathan ``` ## Hugh Davenport, 2014-11-27 02:04 Subject: Re: Where is the best place to report a security vulnerability in git? Message-ID: <760122B3-B9D5-4574-9B0D-1EDF95ED53C0@davenport.net.nz> URL: https://gitlist.dev/e/760122B3-B9D5-4574-9B0D-1EDF95ED53C0%40davenport.net.nz In-Reply-To: <20141127012053.GU6527@google.com> ``` Thanks. Will send a report their way soon On 27 November 2014 2:20:53 pm NZDT, Jonathan Nieder wrote: >Hi Hugh, > >Hugh Davenport wrote: > >> Where is the best place to report a security vulnerability in git? > >Current practice is to contact Junio C Hamano . >Cc-ing Jeff King isn't a bad idea while at it. > >We should probably set up a mailing list to make this more obvious, >but that's what we have today. > >Thanks, >Jonathan -- Sent from my Android device with K-9 Mail. Please excuse my brevity. ``` ## Sitaram Chamarty, 2014-11-27 03:32 Subject: Re: Where is the best place to report a security vulnerability in git? Message-ID: <54769B38.30708@gmail.com> URL: https://gitlist.dev/e/54769B38.30708%40gmail.com In-Reply-To: <20141127012053.GU6527@google.com> ``` On 11/27/2014 06:50 AM, Jonathan Nieder wrote: > Hi Hugh, > > Hugh Davenport wrote: > >> Where is the best place to report a security vulnerability in git? > > Current practice is to contact Junio C Hamano . > Cc-ing Jeff King isn't a bad idea while at it. > > We should probably set up a mailing list to make this more obvious, > but that's what we have today. Hi Hugh, I maintain a somewhat widely used access control program for remote access to git, so I'm interested also. Gitolite [1] and similar systems provide access control for git repos. There's a very good chance that something which is not a concern for "local" use, could become an attack vector if enabled through gitolite. Hence my interest, and my request that I be copied. Jonathan/Junio/Jeff: if such a mailing list does happen please consider adding me into it. regards sitaram [1]: https://gitolite.com ```