@@ -90,32 +90,25 @@ to land but is [author ready](#author-ready-pull-requests), add the |
90 | 90 |
|
91 | 91 | ### Managing security issues |
92 | 92 |
|
93 | | -Security issues should ideally be reported through the processes outlined in |
94 | | -[SECURITY.md][security reporting]. This allows the collaborators to |
95 | | -appropriately triage the report and address vulnerabilities in a planned |
96 | | -security release. If an issue is opened in the public repo |
97 | | -which describes a security issue, or if an issue is later identified to be |
98 | | -describing a security issue, take the following steps: |
99 | | - |
100 | | -* Ask the originator to submit a report through Hacker one as outlined in |
101 | | - [SECURITY.md][security reporting]. |
| 93 | +Use the process outlined in [SECURITY.md][] to report security |
| 94 | +issues. If a user opens a security issue in the public repository: |
| 95 | + |
| 96 | +* Ask the user to submit a report through HackerOne as outlined in |
| 97 | + [SECURITY.md][]. |
102 | 98 | * Move the issue to the private repo called |
103 | 99 | [premature-disclosures](https://github.com/nodejs/premature-disclosures). |
104 | 100 | * For any related pull requests, create an associated issue in the |
105 | 101 | `premature-disclosures` repository. Add a copy of the patch for the |
106 | 102 | pull request to the issue. Add screenshots of discussion from the pull request |
107 | 103 | to the issue. |
108 | | -* Open a ticket with GitHub asking that the pull requests be deleted through |
109 | | - [GitHub support](https://support.github.com/contact) |
110 | | - using Node.js(team) as the account organization. |
111 | | -* Open a new issue in the repository in which the issue was originally |
112 | | - reported with a brief FYI to the originator: "FYI @xxxx we asked GitHub |
113 | | - to delete your pull request while we work on releases in private." with the |
114 | | - title `FYI - pull request deleted #YYYY`. |
115 | | - |
116 | | - `premature-disclosures` repo so that the TSC is aware that they |
117 | | - may need to expedite handling of the issue due to premature |
118 | | - disclosure. |
| 104 | +* [Open a ticket with GitHub](https://support.github.com/contact) to delete the |
| 105 | + pull request using Node.js (team) as the account organization. |
| 106 | +* Open a new issue in the public repository with the title `FYI - pull request |
| 107 | + deleted #YYYY`. Include an explanation for the user: |
| 108 | + > FYI @xxxx we asked GitHub to delete your pull request while we work on |
| 109 | + > releases in private. |
| 110 | + |
| 111 | + `premature-disclosures` repository. |
119 | 112 |
|
120 | 113 | ## Accepting modifications |
121 | 114 |
|
@@ -842,6 +835,7 @@ If you cannot find who to cc for a file, `git shortlog -n -s <file>` can help. |
842 | 835 |
|
843 | 836 | ["Merge Pull Request"]: https://help.github.com/articles/merging-a-pull-request/#merging-a-pull-request-on-github |
844 | 837 | [Deprecation]: https://en.wikipedia.org/wiki/Deprecation |
| 838 | +[SECURITY.md]: https://github.com/nodejs/node/blob/HEAD/SECURITY.md |
845 | 839 | [Stability Index]: ../api/documentation.md#stability-index |
846 | 840 | [TSC]: https://github.com/nodejs/TSC |
847 | 841 | [`--pending-deprecation`]: ../api/cli.md#--pending-deprecation |
@@ -856,5 +850,4 @@ If you cannot find who to cc for a file, `git shortlog -n -s <file>` can help. |
856 | 850 | [git-username]: https://help.github.com/articles/setting-your-username-in-git/ |
857 | 851 | [node-core-utils-credentials]: https://github.com/nodejs/node-core-utils#setting-up-credentials |
858 | 852 | [node-core-utils-issues]: https://github.com/nodejs/node-core-utils/issues |
859 | | -[security reporting]: https://github.com/nodejs/node/blob/HEAD/SECURITY.md |
860 | 853 | [unreliable tests]: https://github.com/nodejs/node/issues?q=is%3Aopen+is%3Aissue+label%3A%22CI+%2F+flaky+test%22 |