[ANN] Loofah vulnerability reporting process

Mike_Dalessio1 · 15 March 2018 21:41

Hi all,

The Loofah project has published a vulnerability reporting process, to
allow private disclosure of security vulnerabilities.

More details are at

github.com

flavorjones/loofah/blob/master/SECURITY.md

# Security and Vulnerability Reporting

The Loofah core contributors take security very seriously and investigate all reported vulnerabilities.

If you would like to report a vulnerablity or have a security concern regarding Loofah, please [report it via HackerOne](https://hackerone.com/loofah/reports/new).

Your report will be acknowledged within 24 hours, and you'll receive a more detailed response within 72 hours indicating next steps in handling your report.

If you have not received a reply to your submission within 48 hours, there are a few steps you can take:

* Contact the current security coordinator (Mike Dalessio <mike.dalessio@gmail.com>)
* Email the Loofah user group at loofah@librelist.com (archive at http://librelist.com)

Please note, the user group list is a public area. When escalating in that venue, please do not discuss your issue. Simply say that you're trying to get a hold of someone from the core team.

The information you share with the Loofah core contributors as part of this process will be kept confidential within the team, unless or until we need to share information upstream with our dependent libraries' core teams, at which point we will notify you.

If a vulnerability is first reported by you, we will credit you with the discovery in the public disclosure.

Or you can report vulnerabilities directly at https://hackerone.com/loofah

Special thanks to HackerOne for their support of OSS projects.

Thanks for reading,
-m

Topic		Replies	Views
[ANN] loofah 2.3.0 released ruby-talk	0	418	28 September 2019
[ruby-talk:444035] [ANN] loofah security update v2.19.1 ruby-talk	0	263	13 December 2022
[ANN] Nokogiri vulnerability reporting process ruby-talk	0	346	15 March 2018
[ANN] loofah 0.4.2 Released ruby-talk	0	97	24 January 2010
[ANN] loofah 0.4.7 Released ruby-talk	1	120	26 October 2010

[ANN] Loofah vulnerability reporting process

Related Topics